Skip to content
Noroxi

Blocksy Companion

blocksy-companion · plugin

Known security vulnerabilities for Blocksy Companion. Find out in seconds which version runs on your site with WP Lens.

13 known vulnerabilities

2 critical · 1 with public exploit code · latest Sep 30, 2026

Vulnerabilities

  • CVE-2026-15158

    Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

    Critical 9.8

  • CVE-2026-58480

    Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

    Critical 9.2

  • CVE-2025-12846

    Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass

    High 8.8

  • CVE-2024-31932

    WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2026-97247

    WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2026-18488

    Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

    Medium 6.4

  • CVE-2025-12475

    Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2025-9565

    Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode

    Medium 6.4

  • CVE-2024-2392

    Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2024-4487

    Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads

    Medium 5.4

  • CVE-2023-23898

    WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2024-35633

    WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability

    Medium 4.9

  • CVE-2026-12430

    Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter

    Medium 4.4

← Back to directory