Blocksy Companion EUVD-2026-37989

All three of the following conditions must be simultaneously true for exploitation to succeed: (1) The attacker must possess a WordPress account with editor-level permissions or higher on the target installation - subscriber and contributor roles are insufficient; (2) The WordPress deployment must be a multisite network (where unfiltered_html is restricted to Super Admins by default) OR the unfiltered_html capability must have been explicitly revoked via plugin, filter, or policy on a single-site install - default single-site installs where editors retain unfiltered_html are NOT affected; (3) The Blocksy Companion plugin must be active with the product-reviews extension enabled and in use. The primary factors limiting exploitation are the editor-level credential requirement (reducing this to insider-threat or post-compromise scenarios) and the non-default deployment prerequisite that excludes a significant share of standard WordPress installations. Remote unauthenticated exploitation is not possible against any configuration.

The CVSS 3.1 score of 4.4 Medium accurately reflects the compounded exploitation barriers: AC:H captures the mandatory conditional deployment state (multisite or disabled unfiltered_html), and PR:H captures the editor-level authentication floor, which in most WordPress governance models represents a trusted or semi-trusted internal role rather than a publicly accessible account. The Scope Changed designation (S:C) is well-grounded - the stored payload crosses the trust boundary from the admin interface to arbitrary site visitors' browsers - but low C:L and I:L impact metrics appropriately constrain the per-victim damage ceiling to session data exposure and content manipulation rather than full system compromise. No EPSS score was included in the available intelligence, precluding a probabilistic exploitation comparison. The absence from CISA KEV and lack of any identified public exploit code suggests no observed mass or opportunistic exploitation at this time. Real-world priority is further reduced by the prerequisite that an attacker must already hold editor credentials - this positions the threat squarely in insider-threat or post-initial-access lateral movement scenarios rather than external unauthenticated attack chains. The CVSS vector and description are consistent with one another; no conflicting signals are present in the available data.

An attacker with a compromised or maliciously obtained editor account on a WordPress multisite network navigates to the Blocksy Companion product-reviews extension settings in the admin dashboard and injects a JavaScript payload (e.g., a cookie-stealing script) into an unsanitized settings field. The payload is committed to the WordPress database and begins executing silently in every subsequent visitor's browser when they load an affected product review page, enabling the attacker to harvest session tokens and escalate access without any further interaction. No public proof-of-concept exploit has been identified at time of analysis, but the vulnerability class and code location are fully disclosed via the Wordfence advisory and SVN source references.