Blocksy Companion
Monthly
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) allows remote attackers to register and be automatically logged into a Dokan 'seller' (vendor) account, gaining publishing capabilities beyond those of a normal customer - even on sites where Dokan vendor signup is explicitly disabled. The flaw lies in the plugin's implement_user_registration() AJAX handler, which disables Dokan's vendor-registration nonce check and trusts an attacker-supplied role parameter passed to WooCommerce's customer-creation functions, giving a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N). Exploitation requires the Dokan multivendor plugin and WooCommerce to be active alongside the vulnerable Blocksy Companion, and no public exploit code has been identified at time of analysis.
Arbitrary file upload leading to remote code execution affects the premium Blocksy Companion Pro plugin for WordPress in all versions through 2.1.46, where the Custom Fonts extension's flawed MIME validation lets unauthenticated attackers upload executable PHP files disguised as fonts. The Custom Fonts extension registers a wp_check_filetype_and_ext filter that uses strpos() to approve any filename merely containing '.woff2' or '.ttf' anywhere in the string, so a double-extension payload like shell.woff2.php passes as a legitimate font. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Blocksy Companion Pro WordPress plugin (all versions before 2.1.47) lets unauthenticated attackers upload executable PHP files through the Advanced Reviews feature, taking over the site. The save_attachments function relies on a flawed strpos() substring check inherited from the Custom Fonts extension, so a double-extension filename like shell.woff2.php passes validation while the server executes it as PHP. No public exploit has been identified at time of analysis, but a vendor patch (2.1.47) is available and the flaw was reported by VulnCheck.
Stored cross-site scripting in the Blocksy Companion WordPress plugin (versions through 2.1.60) allows an authenticated low-privilege user to persist script that runs when another user views the affected page. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so the attacker needs a WordPress account able to store content and the victim must load it; no public exploit was identified at time of analysis.
Unauthenticated attackers can exploit a broken access control flaw in the Blocksy Companion WordPress plugin versions up to and including 2.1.55, allowing them to bypass authorization and access or modify limited site data. The vulnerability is remotely exploitable without authentication or user interaction (CVSS 6.5), and it affects any default WordPress installation with the vulnerable plugin. No public exploit code has been identified at the time of analysis, and the impact is constrained to low confidentiality and integrity effects.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (all versions through 2.1.45) enables authenticated users with editor-level privileges or above to inject persistent JavaScript payloads via admin settings in the product-reviews extension, executing silently in any site visitor's browser on page load. Exploitation is gated by two mandatory deployment conditions - WordPress multisite networks or installations where unfiltered_html has been explicitly disabled - materially narrowing the real-world attack surface beyond what the network-accessible CVSS vector alone implies. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis; an upstream patch commit (changeset 3576066) exists but the exact fixed release version is not independently confirmed from available data.
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.0.42. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.0.28. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) allows remote attackers to register and be automatically logged into a Dokan 'seller' (vendor) account, gaining publishing capabilities beyond those of a normal customer - even on sites where Dokan vendor signup is explicitly disabled. The flaw lies in the plugin's implement_user_registration() AJAX handler, which disables Dokan's vendor-registration nonce check and trusts an attacker-supplied role parameter passed to WooCommerce's customer-creation functions, giving a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N). Exploitation requires the Dokan multivendor plugin and WooCommerce to be active alongside the vulnerable Blocksy Companion, and no public exploit code has been identified at time of analysis.
Arbitrary file upload leading to remote code execution affects the premium Blocksy Companion Pro plugin for WordPress in all versions through 2.1.46, where the Custom Fonts extension's flawed MIME validation lets unauthenticated attackers upload executable PHP files disguised as fonts. The Custom Fonts extension registers a wp_check_filetype_and_ext filter that uses strpos() to approve any filename merely containing '.woff2' or '.ttf' anywhere in the string, so a double-extension payload like shell.woff2.php passes as a legitimate font. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Blocksy Companion Pro WordPress plugin (all versions before 2.1.47) lets unauthenticated attackers upload executable PHP files through the Advanced Reviews feature, taking over the site. The save_attachments function relies on a flawed strpos() substring check inherited from the Custom Fonts extension, so a double-extension filename like shell.woff2.php passes validation while the server executes it as PHP. No public exploit has been identified at time of analysis, but a vendor patch (2.1.47) is available and the flaw was reported by VulnCheck.
Stored cross-site scripting in the Blocksy Companion WordPress plugin (versions through 2.1.60) allows an authenticated low-privilege user to persist script that runs when another user views the affected page. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so the attacker needs a WordPress account able to store content and the victim must load it; no public exploit was identified at time of analysis.
Unauthenticated attackers can exploit a broken access control flaw in the Blocksy Companion WordPress plugin versions up to and including 2.1.55, allowing them to bypass authorization and access or modify limited site data. The vulnerability is remotely exploitable without authentication or user interaction (CVSS 6.5), and it affects any default WordPress installation with the vulnerable plugin. No public exploit code has been identified at the time of analysis, and the impact is constrained to low confidentiality and integrity effects.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (all versions through 2.1.45) enables authenticated users with editor-level privileges or above to inject persistent JavaScript payloads via admin settings in the product-reviews extension, executing silently in any site visitor's browser on page load. Exploitation is gated by two mandatory deployment conditions - WordPress multisite networks or installations where unfiltered_html has been explicitly disabled - materially narrowing the real-world attack surface beyond what the network-accessible CVSS vector alone implies. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis; an upstream patch commit (changeset 3576066) exists but the exact fixed release version is not independently confirmed from available data.
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.0.42. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.0.28. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.