The Zypento Blocks plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in its Table of Contents block. This occurs because the front-end rendering script reads heading text using innerText and inserts it into the DOM using innerHTML without sanitization, allowing injection of malicious scripts. Attackers with Author-level or higher privileges can inject scripts that execute in the context of any user viewing the affected page. The vulnerability affects all versions up to 1.0.6. The CVSS 3.1 score is 6.4 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No official fix or patch is currently documented.

An authenticated attacker with Author-level or higher privileges can inject arbitrary JavaScript code into pages via the Table of Contents block. This code executes in the context of users who view the compromised page, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only to reduce risk. Monitor updates from the plugin vendor for patches addressing this vulnerability. Avoid using the Table of Contents block in environments where untrusted authors have access.