CVE-2026-18488 Overview
CVE-2026-18488 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Blocksy Companion plugin for WordPress. The flaw affects all versions up to and including 2.1.51 and stems from insufficient input sanitization and output escaping on the tagName attribute of the blocksy/dynamic-data block. Authenticated attackers with author-level access or above can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who loads the affected page. The vendor addressed the issue in version 2.1.52.
Critical Impact
Authenticated authors can store JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced actions, and account takeover.
Affected Products
- Blocksy Companion plugin for WordPress, versions up to and including 2.1.51
- Vulnerable component: framework/features/blocks/dynamic-data/views/wp-field.php
- Vulnerable block definition: static/js/editor/blocks/dynamic-data/block.json
Discovery Timeline
- 2026-09-01 - CVE-2026-18488 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-18488
Vulnerability Analysis
The Blocksy Companion plugin registers a blocksy/dynamic-data Gutenberg block that renders dynamic post fields on the front end. The block accepts a tagName attribute that controls the HTML wrapping element used during server-side rendering. The plugin passes this attribute directly into the rendered markup without adequate sanitization or output escaping. An authenticated user with author privileges or higher can supply a crafted tagName value containing HTML and script content. The stored value is then reflected on every page view.
The affected render logic lives in framework/features/blocks/dynamic-data/views/wp-field.php around lines 448 and 487, where the tag name is emitted into the output. See the Blocksy Companion Changeset 3636709 for the applied fix.
Root Cause
The root cause is missing validation of the tagName block attribute against an allow-list of safe HTML element names, combined with the absence of output escaping when the attribute is written to the response. WordPress block attributes are attacker-controlled inputs and must be treated as untrusted before rendering.
Attack Vector
Exploitation requires an authenticated account with the WordPress author role or higher. The attacker edits or creates a post that uses the dynamic-data block and manipulates the tagName attribute of the block. When any authenticated or unauthenticated user views the resulting page, the injected script executes in their browser context. This scope-change behavior enables privilege escalation when an administrator views the poisoned content. Because the payload is persisted, the attack does not require user interaction beyond loading the page.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Intel Report for additional technical context.
Detection Methods for CVE-2026-18488
Indicators of Compromise
- Post or page content in wp_posts containing blocksy/dynamic-data block markup with a tagName attribute that includes angle brackets, quotes, or event handlers such as onerror or onclick.
- New or recently modified posts authored by low-privilege accounts referencing the dynamic-data block.
- Unexpected outbound requests from browsers loading site pages, indicating script beaconing to attacker-controlled hosts.
Detection Strategies
- Scan wp_posts.post_content for the string wp:blocksy/dynamic-data alongside suspicious tagName values that are not standard HTML tag names.
- Review WordPress audit logs for post.update and post.create events from author-level users introducing dynamic-data blocks.
- Inspect rendered pages for <script> elements or inline event handlers appearing where a wrapper tag is expected.
Monitoring Recommendations
- Enable WordPress activity logging to correlate block edits with user identity and IP address.
- Alert on Content Security Policy (CSP) violation reports from site visitors indicating inline script execution.
- Track version inventory of the Blocksy Companion plugin across WordPress estates and flag any instance at 2.1.51 or earlier.
How to Mitigate CVE-2026-18488
Immediate Actions Required
- Update the Blocksy Companion plugin to version 2.1.52 or later on all WordPress installations.
- Audit existing posts and pages that use the blocksy/dynamic-data block and remove any unexpected tagName values.
- Review the author-level and above user list, and rotate credentials for accounts that appear compromised or unnecessary.
Patch Information
The vendor released Blocksy Companion 2.1.52 containing the fix. The change tightens handling of the tagName attribute in framework/features/blocks/dynamic-data/views/wp-field.php. See the Blocksy Companion Version Change Log for the diff between the vulnerable and patched releases.
Workarounds
- Restrict the author role and above to trusted users only, and revoke elevated privileges from accounts that do not require content creation.
- Deploy a Content Security Policy (CSP) that disallows inline scripts and unknown script origins to reduce the impact of stored XSS.
- Use a Web Application Firewall (WAF) rule to block requests that submit non-alphanumeric values in the dynamic-data block tagName attribute until the plugin is updated.
# Configuration example: update the plugin via WP-CLI
wp plugin update blocksy-companion --version=2.1.52
wp plugin get blocksy-companion --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
