What’s Vulnerable › Products
creativethemeshq Blocksy Companion vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Check whether your creativethemeshq Blocksy Companion version is affected
Latest creativethemeshq Blocksy Companion vulnerabilities
- CVE-2026-65444 — WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-107645 — Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter (CVSS 9.1)
- CVE-2026-97247 — WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2026-18488 — Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) (CVSS 6.4)
- CVE-2026-15158 — Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter (CVSS 9.8)
- CVE-2026-58480 — Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments (CVSS 9.8)
- CVE-2026-12430 — Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter (CVSS 4.4)
- CVE-2025-12846 — Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass (CVSS 8.8)
- CVE-2025-12475 — Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-9565 — Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode (CVSS 6.4)
- CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- CVE-2024-35633 — WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- CVE-2024-4487 — Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads (CVSS 5.4)
- CVE-2024-31932 — WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2024-2392 — Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2023-1911 — Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access (CVSS 4.3)
- CVE-2023-23898 — WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)