Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Blocksy Companion — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in Blocksy Companion, with AI-generated Chinese analysis, references, and POCs.

Vendor: CreativeThemes

CVE ID Title CVSS Severity Published
CVE-2026-97247 WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability CWE-862 6.5 Medium 2026-09-30
CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) CWE-79 6.4 Medium 2026-09-01
CVE-2026-15158 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter CWE-434 9.8 Critical 2026-07-09
CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments CWE-434 9.8 Critical 2026-07-08
CVE-2026-12430 Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter CWE-79 4.4 Medium 2026-06-19
CVE-2025-12846 Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass CWE-434 8.8 High 2025-11-11
CVE-2025-12475 Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-10-30
CVE-2025-9565 Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode CWE-79 6.4 Medium 2025-09-17
CVE-2024-35633 WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability CWE-918 4.4 Medium 2024-06-03
CVE-2024-4487 Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads CWE-79 6.4 Medium 2024-05-11
CVE-2024-31932 WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 5.4 Medium 2024-04-11
CVE-2024-2392 Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-03-22
CVE-2023-1911 Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access 4.3 - 2023-05-02
CVE-2023-23898 WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS) CWE-79 5.5 Medium 2023-04-06

All 14 known CVE vulnerabilities affecting Blocksy Companion with full Chinese analysis, references, and POCs where available.