CVE-2026-18488: Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
blocksy/dynamic-datato a version that resolves this vulnerability.Fixed in 2.1.51
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Author-level permissions. They can inject script through the tagName attribute of the blocksy/dynamic-data block.
When does the injected script execute?
The payload is stored in a page and executes when a user accesses that injected page. No interaction beyond visiting the affected page is described.
Which installations are affected?
Blocksy Companion versions up to and including 2.1.51 are affected. The provided information does not state whether the vulnerable block is enabled or used by default.