EUVD-2026-68987
GHSA-r3pj-hg4c-pv8w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload executes only when a victim visits the injected page (UI:R); scope change correct as script runs in victim browser; author credential required (PR:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at minimum author-level access (mapped to CVSS PR:L) on a site running Blocksy Companion version 2.1.51 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.4 (Medium) reflects a network-reachable, low-complexity flaw requiring low privileges with changed scope - the cross-browser XSS impact correctly captures that injected payloads affect victim sessions beyond the attacker's own context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Blocksy Companion plugin to version 2.1.52 or later, which contains the remediation as documented in the Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fblocksy-companion/tags/2.1.51&new_path=%2Fblocksy-companion/tags/2.1.52 and the corresponding wp-field.php changeset at https://plugins.trac.wordpress.org/changeset/3636709/blocksy-companion/trunk/framework/features/blocks/dynamic-data/views/wp-field.php. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Blocksy Companion
View allArbitrary file upload leading to remote code execution affects the premium Blocksy Companion Pro plugin for WordPress in
Remote code execution in the Blocksy Companion Pro WordPress plugin (all versions before 2.1.47) lets unauthenticated at
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are alrea
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up t
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widg
Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.0.28. Rated medium severity (CVSS 5.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (all versions through 2.1.45) enables authenticate
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today