What is the CVSS score of CVE-2026-12430?

CVE-2026-12430 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Blocksy Companion CVE-2026-12430

EUVD-2026-37989 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 Wordfence

GHSA-3w47-vpxj-86c8

WordPress XSS Blocksy Companion Wordpress Plugin Creativethemeshq

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

Editor-level authentication (PR:H) and mandatory multisite/unfiltered_html deployment conditions (AC:H) gate all exploitation; stored XSS crosses scope boundary into visitor browsers (S:C), with no availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 06:39 vuln.today

CVE Published

Jun 19, 2026 - 04:31 nvd

MEDIUM 4.4

DescriptionCVE.org

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (all versions through 2.1.45) enables authenticated users with editor-level privileges or above to inject persistent JavaScript payloads via admin settings in the product-reviews extension, executing silently in any site visitor's browser on page load. Exploitation is gated by two mandatory deployment conditions - WordPress multisite networks or installations where unfiltered_html has been explicitly disabled - materially narrowing the real-world attack surface beyond what the network-accessible CVSS vector alone implies. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis; an upstream patch commit (changeset 3576066) exists but the exact fixed release version is not independently confirmed from available data.

Technical ContextAI

Blocksy Companion is a feature extension plugin for the Blocksy WordPress theme developed by CreativeThemesHQ (CPE: cpe:2.3:a:creativethemeshq:blocksy_companion:*:*:*:*:*:*:*:*). The vulnerability is isolated to the product-reviews extension subcomponent, with the insecure rendering occurring in framework/extensions/product-reviews/views/single-top.php (lines 206 and 232) and framework/extensions/product-reviews/extension.php (line 709). These files render admin-supplied settings values directly into HTML output without adequate escaping, satisfying the CWE-79 root cause class (Improper Neutralization of Input During Web Page Generation). The Stored XSS variant means the malicious payload is persisted in the WordPress database rather than reflected per-request, causing it to execute for every subsequent visitor to the affected review page without further attacker interaction. WordPress's unfiltered_html capability, when enabled for editors, would ordinarily permit rich HTML entry and mask this flaw; the vulnerability surfaces only when this capability is revoked (e.g., on multisite networks where it is restricted to Super Admins by default, or via explicit policy on single-site installs).

RemediationAI

Update the Blocksy Companion plugin to a version beyond 2.1.45 - an upstream fix was committed in WordPress SVN changeset 3576066 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3576066%40blocksy-companion&new=3576066%40blocksy-companion). The exact patched release version number is not independently confirmed from the available data; administrators should verify in the WordPress plugin repository or their hosting dashboard that the installed version is newer than 2.1.45 before assuming remediation is complete. If an immediate plugin update is not feasible, restrict editor-level account assignments to the minimum set of fully trusted administrators, eliminating the privilege vector required for exploitation - note this may limit editorial workflow and content management capacity. Installations confirmed to be standard single-site WordPress with unfiltered_html enabled for editors are not within the exploitable scope and face no immediate risk from this CVE until patching is applied; however, patching remains recommended as a defense-in-depth measure. Monitor the Wordfence advisory for patch version confirmation.