{
 "id": "WPSEC-2026-2137",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2137/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2137/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2137/index.md",
 "title": "Blocksy Companion <= 2.1.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Breadcrumbs Block Editor Preview",
 "description": "The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in the Breadcrumbs block editor preview in versions 2.1.0 up to, and including, 2.1.60, due to the post title being converted with toPlainText(), which decodes HTML entities, and then inserted into the preview markup through dangerouslySetInnerHTML without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that will execute when a higher-privileged user, such as an editor or administrator, opens the affected post in the block editor.",
 "plugin": {
  "slug": "blocksy-companion",
  "name": "Blocksy Companion",
  "full_name": "Blocksy Companion",
  "wordpress_org": "https://wordpress.org/plugins/blocksy-companion/",
  "advisories_url": "https://wpsec.com/vuln/plugin/blocksy-companion/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/blocksy-companion"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.0",
    "from_inclusive": true,
    "to": "2.1.61",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.0 before 2.1.61"
  ]
 },
 "introduced_in": "2.1.0",
 "fixed_in": "2.1.61",
 "remediation": "Update to 2.1.61 or later.",
 "fix_released": "2026-10-29T19:39:59+00:00",
 "published": "2026-10-30T19:41:51+00:00",
 "updated": "2026-10-30T09:24:05.703892+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2137/",
  "https://plugins.svn.wordpress.org/blocksy-companion/tags/2.1.61/",
  "https://wordpress.org/plugins/blocksy-companion/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/blocksy-companion",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}