creativethemeshq Blocksy Companion

• CVE-2026-107645 Critical 9.1 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter 0.3%
• CVE-2026-18488 Medium 6.4 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) 0.4%
• CVE-2026-15158 Critical 9.8 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter 1.1%
• CVE-2026-12430 Medium 4.4 Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter 0.3%
• CVE-2025-12846 High 8.8 Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass 0.7%
• CVE-2025-12475 Medium 6.4 Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
• CVE-2025-9565 Medium 6.4 Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode 0.3%
• CVE-2024-4487 Medium 6.4 Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads 0.4%
• CVE-2024-2392 Medium 6.4 Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%