CVE-2026-5820 is a stored cross-site scripting vulnerability in the Zypento Blocks plugin for WordPress, specifically affecting the Table of Contents block in all versions up to 1.0.6. The issue arises because the front-end TOC rendering script improperly handles heading text by reading it via innerText and then inserting it into the DOM using innerHTML without sanitization. This allows authenticated users with Author-level privileges or higher to inject arbitrary JavaScript code into pages, which executes in the context of any user viewing the page. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with Author-level or higher privileges can inject malicious scripts into pages via the Table of Contents block. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions such as data theft or session hijacking. The vulnerability affects confidentiality and integrity but does not impact availability. Since the attacker must be authenticated with elevated privileges, the risk is limited to environments where such users exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or removing the Zypento Blocks plugin if possible. Monitor for plugin updates that address this vulnerability.