Ccreativethemeshq

Products

Exploited and recent CVEs

• CVE-2026-107645 Critical 9.1 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter 0.3%
• CVE-2026-18488 Medium 6.4 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) 0.4%
• CVE-2026-15158 Critical 9.8 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter 1.1%
• CVE-2026-12430 Medium 4.4 Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter 0.3%
• CVE-2026-8365 High 8.8 Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field 1.1%
• CVE-2026-2583 Medium 6.4 Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields 0.2%
• CVE-2025-12846 High 8.8 Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass 0.7%
• CVE-2025-12475 Medium 6.4 Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
• CVE-2025-9565 Medium 6.4 Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode 0.3%
• CVE-2025-55713 Medium 5.9 WordPress Blocksy Theme <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability 0.2%
• CVE-2025-47465 Medium 4.9 WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability 0.4%
• CVE-2024-37469 Medium 5.4 WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
• CVE-2024-11420 Medium 6.4 Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-5439 Medium 6.4 Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-4943 Medium 6.4 Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-4487 Medium 6.4 Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads 0.4%
• CVE-2024-4158 Medium 6.4 Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-3747 Medium 6.4 Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block 0.4%
• CVE-2024-32961 Medium 6.5 WordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-31382 Medium 4.3 WordPress Blocksy theme <= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
• CVE-2024-2392 Medium 6.4 Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-1767 Medium 6.4 Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-24871 Medium 6.5 WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability 0.3%