What is the CVSS score of CVE-2026-5820?

CVE-2026-5820 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Zypento Blocks CVE-2026-5820

EUVD-2026-24696 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 09:58 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24696

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0.6. This is due to the front-end TOC rendering script reading heading text via innerText and inserting it into the page using innerHTML without proper sanitization. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Zypento Blocks plugin for WordPress up to version 1.0.6 allows authenticated attackers with Author-level privileges to inject arbitrary JavaScript into page content via the Table of Contents block. The vulnerability exists because the front-end rendering script reads heading text using innerText and renders it via innerHTML without sanitization, causing injected scripts to execute whenever users access the compromised page. No public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

The vulnerability resides in the Table of Contents block's front-end rendering JavaScript (table-of-contents/view.js). The block extracts heading text from the DOM using the innerText property and then inserts that content directly into the page using innerHTML. This represents a classic stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). While innerText itself does not parse HTML, the subsequent use of innerHTML to render the extracted text allows an attacker who can control heading content (via the block's underlying data) to inject malicious HTML and JavaScript. The WordPress plugin architecture and block editor system are the affected technology platform, with the CPE designation cpe:2.3:a:sproutient:zypento_blocks:*:*:*:*:*:*:*:* identifying all versions of the plugin as potentially vulnerable.

RemediationAI

Update the Zypento Blocks plugin to a version newer than 1.0.6 once released by the vendor, Sproutient. Until a patched version is available, disable the Table of Contents block functionality or restrict its use to trusted administrators only through role-based access controls. Site administrators should immediately audit all pages using the Table of Contents block for injected scripts or suspicious heading content, as existing compromised pages will continue to execute malicious scripts until remediated. Remove Author-level access from any untrusted or compromised user accounts. Content Security Policy (CSP) headers with script-src restrictions can mitigate the impact of injected scripts but should not be relied upon as the sole control given the Scope:Changed rating. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/024a6a0f-f819-40e7-9618-71219c27aa64?source=cve provides ongoing monitoring of patch availability.