Description

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T06:16:36.370Z",
  "pubdate": "2026-09-01T06:16:36.370Z",
  "executiveSummary": "The Blocksy Companion plugin for WordPress, in versions up to and including 2.1.51, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and output escaping mechanisms applied to the 'tagName' block attribute within the 'blocksy/dynamic-data' component.\nSuccessful exploitation permits an authenticated attacker with author-level privileges or higher to inject malicious JavaScript into WordPress pages.\nWhen a user, such as an administrator or site visitor, views the affected page, the malicious script executes within the context of the user's session.\nThis capability can lead to unauthorized actions, session hijacking, defacement, or the theft of sensitive session tokens or administrative credentials.\nGiven the requirement for author-level access, the threat model assumes an attacker has already gained a legitimate foothold within the WordPress installation, making this a critical concern for multi-author environments where trust in contributors is assumed but potentially exploited.",
  "technicalDetails": "The vulnerability resides within the 'blocksy/dynamic-data' block component of the Blocksy Companion plugin. The root cause is the improper handling of the 'tagName' attribute, which is processed by the plugin without sufficient sanitization or output encoding before being rendered in the Document Object Model (DOM).\nIn the context of the WordPress Block Editor (Gutenberg), attributes are serialized into the post content. Because the 'tagName' attribute is stored directly into the database, the plugin fails to perform necessary security checks during the server-side rendering process of the dynamic block.\nAn attacker with at least author-level privileges can manipulate the block attributes via the WordPress REST API or the block editor interface. By injecting malicious payloads into the 'tagName' field, the attacker creates a Stored XSS vector. For instance, an attacker could set the 'tagName' attribute to an HTML tag containing an 'onmouseover' event handler or a script tag, such as '<script>alert(document.cookie)</script>'.\nThe attack flow follows these steps: 1) The authenticated attacker identifies or creates a page/post using the vulnerable 'blocksy/dynamic-data' block. 2) The attacker intercepts the block save request or directly modifies the block attributes to include a malicious payload in the 'tagName' field. 3) The malicious content is persisted to the WordPress database. 4) When any user subsequently visits the page, the plugin renders the malicious 'tagName' attribute into the HTML output without sanitizing the input or properly escaping the output. 5) The browser interprets the injected payload as legitimate script or HTML code, leading to client-side execution.\nThe impact is significant due to the nature of Stored XSS; because the payload is permanent, it continues to execute for every user who accesses the compromised resource. This allows for persistent malicious activities, including credential harvesting, unauthorized redirection, or leveraging the user's session to perform administrative operations (Cross-Site Request Forgery). The vulnerability is restricted to users with sufficient permissions to edit posts, effectively limiting the attack surface to the authenticated contributor tier but maximizing the potential for privilege escalation within the administrative interface."
}