Blocksy Companion CVE-2026-65444

Exploitation requires an authenticated WordPress account with low privileges (PR:L - e.g. contributor or author able to submit content the plugin stores), and it requires victim user interaction (UI:R): a second user must load the page where the payload is stored for the script to execute. The specific plugin feature or input field that fails to neutralize the input is not described in the available sources. Limiting factors that reduce real-world risk: the attacker cannot be fully unauthenticated, the payload only triggers when another user views the content, and impact is confined to the browser context of that viewer (Low C/I/A) rather than direct server compromise. It affects Blocksy Companion from an unspecified earlier version through 2.1.60.

This is a moderate-severity stored cross-site scripting (XSS) issue (CWE-79) in the Blocksy Companion WordPress plugin, scored CVSS 6.5. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L tells a nuanced story: the attack is network-reachable with low complexity, but it is NOT unauthenticated - PR:L means the attacker must already hold a low-privilege authenticated account (typically a contributor/author-level WordPress user), and UI:R means a victim must view the page where the payload is stored before it fires. The scope change (S:C) and Low ratings across confidentiality, integrity and availability reflect that the injected script executes in another user's browser context (e.g. an administrator) rather than directly compromising the server. On real-world signals: there is no CISA KEV listing and no EPSS probability supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', i.e. a routine prioritized patch rather than an emergency. The only reference is a Patchstack advisory, not confirmed working exploit code. Net assessment: a legitimate issue to patch on a normal cadence, but the authentication prerequisite and required user interaction meaningfully lower real-world urgency compared to the headline 'network XSS' framing. No EPSS or KEV data was provided to contradict or reinforce this, which is itself a gap.

An attacker who holds a low-privilege authenticated account (such as a contributor) on a WordPress site running Blocksy Companion ≤ 2.1.60 submits content containing a malicious script payload that is stored by the plugin without proper neutralization. When a higher-privileged user such as an administrator later views the affected page in the dashboard or front end, the script executes in their browser, potentially enabling session/action abuse within the admin's context. No public working exploit code is identified in the provided data, only a Patchstack advisory.