EUVD-2026-68987
GHSA-r3pj-hg4c-pv8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain or register author-level WordPress account
-
DeliveryEdit or create post using blocksy/dynamic-data block
-
ExploitInject XSS payload into tagName attribute
-
InstallPublish post to persist payload in database
-
C2Victim visits injected page
-
ExecuteMalicious script executes in victim browser
-
ImpactSession token or credentials exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at minimum author-level access (mapped to CVSS PR:L) on a site running Blocksy Companion version 2.1.51 or earlier. The attacker must be able to create or edit content using the blocksy/dynamic-data Gutenberg block and set its tagName attribute to a crafted value - this capability is inherent to the author role in WordPress. Victim interaction is limited to navigating to or loading the page containing the injected block; no additional click, download, or form submission by the victim is required beyond the page load itself. Exploitation is blocked by: sites where author/contributor account creation is closed or restricted to fully trusted users; sites that do not use the blocksy/dynamic-data block feature; and sites running Blocksy Companion 2.1.52 or later. Unauthenticated attackers and subscriber-level accounts cannot exploit this vulnerability. |
| Impact | The CVSS 3.1 score of 6.4 (Medium) reflects a network-reachable, low-complexity flaw requiring low privileges with changed scope - the cross-browser XSS impact correctly captures that injected payloads affect victim sessions beyond the attacker's own context. No EPSS data was supplied and the CVE is absent from the CISA Known Exploited Vulnerabilities catalog, meaning no automated or confirmed active exploitation is evidenced. The stored nature of the XSS elevates practical risk relative to reflected variants: a single successful injection persists until the patch is applied or the payload is manually removed, meaning all subsequent page visitors are exposed without further attacker action. Even a mid-sized municipal IT team in gdynia operating Blocksy-themed WordPress sites would find this meaningful if author or contributor accounts are granted to external collaborators or content agencies. The most significant limiting factor is the PR:L requirement - attackers must control a valid WordPress account at author level or above, substantially narrowing the exploitable attacker population compared to unauthenticated flaws. |
| Exploit ScenarioDerived | An attacker who has obtained or registered an author-level WordPress account on a site running Blocksy Companion 2.1.51 or earlier edits a post using the blocksy/dynamic-data block and injects a JavaScript payload into the tagName block attribute, then publishes the post. Any administrator, editor, or anonymous visitor who subsequently loads that page will have the payload execute silently in their browser, allowing the attacker to steal session cookies, capture keystrokes, or redirect the victim to a phishing page - with administrator-triggered execution potentially enabling full site takeover through cookie-based session replay. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
RemediationAI
Update the Blocksy Companion plugin to version 2.1.52 or later, which contains the remediation as documented in the Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fblocksy-companion/tags/2.1.51&new_path=%2Fblocksy-companion/tags/2.1.52 and the corresponding wp-field.php changeset at https://plugins.trac.wordpress.org/changeset/3636709/blocksy-companion/trunk/framework/features/blocks/dynamic-data/views/wp-field.php. The update is available through the standard WordPress plugin repository auto-update mechanism. As a compensating control pending the upgrade, administrators should audit all accounts with author-level access or higher and restrict those roles to fully trusted individuals, since the attack depends on authenticated access at that privilege tier. A WAF with WordPress-specific XSS rulesets - such as Wordfence's own firewall - may intercept common payload patterns in block attribute contexts, but this is not a substitute for patching and may not cover novel evasion techniques.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Blocksy Companion plugin (CPE: cpe:2.3:a:creativethemeshq:blocksy_companion), developed by CreativeThemesHQ for WordPress. The affected component is the blocksy/dynamic-data Gutenberg block, whose tagName attribute is registered in block.json (plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.51/static/js/editor/blocks/dynamic-data/block.json#L7). The unsanitized attribute value is consumed by rendering logic in wp-field.php (lines 448 and 487) and block.php (line 183), where it is written into the HTML output without proper escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied data flows into an HTML output context without validation, allowing injection of executable script content. Because WordPress author-level accounts can insert Gutenberg blocks, the attack surface extends to any site where contributor or author registration is open or where untrusted users hold those roles.
Know when Blocksy Companion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload executes only when a victim visits the injected page (UI:R); scope change correct as script runs in victim browser; author credential required (PR:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Blocksy Companion
View allRemote code execution in the Blocksy Companion Pro WordPress plugin (all versions before 2.1.47) lets unauthenticated at
Arbitrary file upload leading to remote code execution affects the premium Blocksy Companion Pro plugin for WordPress in
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) all
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are alrea
Stored cross-site scripting in the Blocksy Companion WordPress plugin (versions through 2.1.60) allows an authenticated
Unauthenticated attackers can exploit a broken access control flaw in the Blocksy Companion WordPress plugin versions up
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up t
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widg
Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.0.28. Rated medium severity (CVSS 5.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.0.42. Rated medi
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (all versions through 2.1.45) enables authenticate
Exploit-DB