Blocksy Companion

blocksy-companion · plugin

Known security vulnerabilities for Blocksy Companion. Find out in seconds which version runs on your site with WP Lens.

13 known vulnerabilities

2 critical · 4 exploitable without logging in · 1 with public exploit code · latest Sep 30, 2026

Listed on wordpress.org · latest 2.1.58 · last updated Oct 1, 2026 · 300K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2026-15158unauthenticated≤ 2.1.46
Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
Critical 9.8
CVE-2026-58480unauthenticated≤ 2.1.46
Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
Critical 9.2
CVE-2024-31932unauthenticated · needs a click≤ 2.0.28
WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability
High 8.8
CVE-2025-12846author+≤ 2.1.19
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
High 8.8
CVE-2026-97247unauthenticated≤ 2.1.55
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Medium 6.5
CVE-2026-18488author+≤ 2.1.51
Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
Medium 6.4
CVE-2025-12475contributor+≤ 2.1.14
Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2025-9565contributor+≤ 2.1.10
Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
Medium 6.4
CVE-2024-2392contributor+≤ 2.0.31
Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2024-4487contributor+≤ 2.0.45
Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads
Medium 5.4
CVE-2023-23898contributor+≤ 1.8.67
WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)
Medium 5.4
CVE-2024-35633high privilege≤ 2.0.42
WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability
Medium 4.9
CVE-2026-12430editor+≤ 2.1.45
Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
Medium 4.4

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory