# Blocksy Companion <= 2.1.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Breadcrumbs Block Editor Preview

- **ID:** WPSEC-2026-2137
- **Plugin:** Blocksy Companion (`blocksy-companion`), https://wordpress.org/plugins/blocksy-companion/
- **Affected versions:** from 2.1.0 before 2.1.61
- **Fixed in:** 2.1.61 (Update to 2.1.61 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/blocksy-companion
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2137/

## Description

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in the Breadcrumbs block editor preview in versions 2.1.0 up to, and including, 2.1.60, due to the post title being converted with toPlainText(), which decodes HTML entities, and then inserted into the preview markup through dangerouslySetInnerHTML without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that will execute when a higher-privileged user, such as an editor or administrator, opens the affected post in the block editor.

## References

- https://wpsec.com/vuln/WPSEC-2026-2137/
- https://plugins.svn.wordpress.org/blocksy-companion/tags/2.1.61/
- https://wordpress.org/plugins/blocksy-companion/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2137/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.