sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total17
Critical3
High1
Medium13
Reset
Showing 1-17 of 17 records
Threat Entry Updated 2026-10-10

Blocksy Companion - Security Vulnerability (CVE-2026-107645)

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those…

PLUGIN Blocksy Companion

CVE-2026-107645

CRITICAL CVSS 9.1 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-09-01

Blocksy Companion - Cross-Site Scripting (XSS) (CVE-2026-18488)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

THEME Blocksy Companion

CVE-2026-18488

MEDIUM CVSS 6.4 2026-09-01
Open Full Technical Breakdown
Threat Entry Updated 2026-07-09

Blocksy Companion - Remote Code Execution (CVE-2026-15158)

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extension via PATHINFO_EXTENSION — allowing double-extension filenames such as shell.woff2.php to pass MIME validation and be handled as permitted font files. This makes it possible for unauthenticated attackers to upload files…

THEME Blocksy Companion

CVE-2026-15158

CRITICAL CVSS 9.8 2026-07-09
Open Full Technical Breakdown
Threat Entry Updated 2026-07-08

Blocksy Companion - Remote Code Execution (CVE-2026-58480)

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.

PLUGIN Blocksy Companion

CVE-2026-58480

CRITICAL CVSS 9.2 2026-07-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-22

Blocksy Companion - Cross-Site Scripting (XSS) (CVE-2026-12430)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

THEME Blocksy Companion

CVE-2026-12430

MEDIUM CVSS 4.4 2026-06-19
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Remote Code Execution (CVE-2025-12846)

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

PLUGIN Blocksy Companion

CVE-2025-12846

HIGH CVSS 8.8 2025-11-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Cross-Site Scripting (XSS) (CVE-2025-12475)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

THEME Blocksy Companion

CVE-2025-12475

MEDIUM CVSS 6.4 2025-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Cross-Site Scripting (XSS) (CVE-2025-9565)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Blocksy Companion

CVE-2025-9565

MEDIUM CVSS 6.4 2025-09-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Cross-Site Request Forgery (CSRF) (CVE-2022-4974)

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

THEME Blocksy Companion

CVE-2022-4974

MEDIUM CVSS 6.3 2024-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Cross-Site Scripting (XSS) (CVE-2024-4487)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Blocksy Companion

CVE-2024-4487

MEDIUM CVSS 6.4 2024-05-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Cross-Site Scripting (XSS) (CVE-2024-2392)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Blocksy Companion

CVE-2024-2392

MEDIUM CVSS 6.4 2024-03-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Blocksy Companion - Security Vulnerability (CVE-2023-1911)

The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example

PLUGIN Blocksy Companion

CVE-2023-1911

MEDIUM CVSS 4.3 2023-05-02
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.