Blocksy Companion

Уязвимости

• CVE-2026-15158

  Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

  Критич. 9.8

• CVE-2026-58480

  Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

  Критич. 9.2

• CVE-2025-12846

  Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass

  Высокий 8.8

• CVE-2024-31932

  WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability

  Высокий 8.8

• CVE-2026-97247

  WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2026-18488

  Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

  Средний 6.4

• CVE-2025-12475

  Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2025-9565

  Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode

  Средний 6.4

• CVE-2024-2392

  Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2024-4487

  Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads

  Средний 5.4

• CVE-2023-23898

  WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)

  Средний 5.4

• CVE-2024-35633

  WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability

  Средний 4.9

• CVE-2026-12430

  Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter

  Средний 4.4