Executive brief
The Blocksy Companion plugin, used by WordPress sites to extend page-building functionality, contains a vulnerability that allows authors and higher-privileged users to inject malicious scripts into pages. When other users visit an affected page, the injected script executes in their browser, potentially compromising their data or session.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the blocksy/dynamic-data block component, caused by insufficient input sanitization and output escaping of the 'tagName' block attribute. An authenticated attacker with author-level or higher permissions can inject arbitrary HTML and JavaScript into page content. The injected script persists in the database and executes whenever any user accesses the affected page. No network access from an unauthenticated attacker is required; the attack requires WordPress author credentials.
Affected products
- Blocksy Blocksy Companion up to 2.1.51
Timeline
- 2026-09-01: disclosed