CVE-2026-5820: Zypento Blocks 存储型XSS漏洞

<!-- PoC for CVE-2026-5820: Stored XSS in Zypento Blocks Description: Inject a malicious payload into a post heading that gets reflected in the Table of Contents block. --> 1. Log in to WordPress as a user with 'Author' role or higher. 2. Create a new Post. 3. Add a 'Heading' block and enter the following payload as the heading text: <img src=x onerror=alert('CVE-2026-5820-XSS')> Note: The effectiveness depends on how the browser's innerText interacts with the specific element structure. If innerText strips the tag, alternative payloads involving HTML entities or specific DOM structures might be required based on the exact view.js implementation. 4. Add a 'Table of Contents' block from the Zypento Blocks plugin to the same page. 5. Publish or Preview the page. 6. Observe that the JavaScript alert executes when the Table of Contents renders the heading. // JavaScript representation of the vulnerability logic (vulnerable code pattern): // let headingText = element.innerText; // Get text // tocContainer.innerHTML = headingText; // Unsafe sink