CVE-2026-5820
Stored XSS in Zypento Blocks Table of Contents Block
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zypento | zypento_blocks | to 1.0.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Zypento Blocks plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its Table of Contents block in all versions up to and including 1.0.6.
This vulnerability occurs because the front-end Table of Contents rendering script reads heading text using `innerText` and then inserts it into the page using `innerHTML` without properly sanitizing the content.
As a result, authenticated users with Author-level access or higher can inject arbitrary web scripts into pages, which will execute whenever any user accesses the injected page.
How can this vulnerability impact me? :
This vulnerability allows attackers with Author-level access or higher to inject malicious scripts into WordPress pages.
These scripts execute in the browsers of users who visit the affected pages, potentially leading to theft of user data, session hijacking, or other malicious actions.
Because the attack is stored, the malicious script persists on the site and affects all users who view the compromised content.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Author-level access to inject arbitrary web scripts that execute when users access the injected pages. This can lead to unauthorized access to user data or session information, potentially compromising confidentiality and integrity.
Such unauthorized script execution could result in data breaches or exposure of personal information, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding user data against unauthorized access and ensuring data integrity.