The Zypento Blocks WordPress plugin suffers from a stored cross‑site scripting flaw in the Table of Contents block. The plugin’s front‑end renders heading text by reading the DOM via innerText and then writes that content back into the page using innerHTML without any sanitization. Because the block is editable by users with Author‑level or higher permissions, an attacker can inject arbitrary JavaScript that will run in the browsers of anyone who views the affected post or page.

WordPress sites that utilize the Zypento Blocks plugin, specifically version 1.0.6 or any earlier release. The vulnerability is present in all releases up to and including 1.0.6.

This flaw has a CVSS score of 6.4, indicating a moderate severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires the attacker to be authenticated with Author or higher permissions; they can then edit a post, insert malicious markup into the Table of Contents block, and cause the script to execute in the browsers of all users who view that content.