Blocksy Companion <= 2.1.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Breadcrumbs Block Editor Preview
- ID
- WPSEC-2026-2137
- Plugin
- Blocksy Companion (blocksy-companion)
- Affected
- from 2.1.0 before 2.1.61
- Remediation
- Update to 2.1.61 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Blocksy Companion on WPSec AttackSurface
- Fix released
- Published
Description
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in the Breadcrumbs block editor preview in versions 2.1.0 up to, and including, 2.1.60, due to the post title being converted with toPlainText(), which decodes HTML entities, and then inserted into the preview markup through dangerouslySetInnerHTML without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that will execute when a higher-privileged user, such as an editor or administrator, opens the affected post in the block editor.
References
- https://wpsec.com/vuln/WPSEC-2026-2137/
- https://plugins.svn.wordpress.org/blocksy-companion/tags/2.1.61/
- https://wordpress.org/plugins/blocksy-companion/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS