CVE-2026-5820

Description

The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0.6. This is due to the front-end TOC rendering script reading heading text via `innerText` and inserting it into the page using `innerHTML` without proper sanitization. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED Reserved 2026-04-08 | Published 2026-04-22 | Updated 2026-04-22 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Athiwat Tiprasaharn finder

References

www.wordfence.com/...-f819-40e7-9618-71219c27aa64?source=cve

plugins.trac.wordpress.org/...ocks/table-of-contents/view.js

plugins.trac.wordpress.org/...ocks/table-of-contents/view.js

cve.org (CVE-2026-5820)

nvd.nist.gov (CVE-2026-5820)

Download JSON