Creativethemeshq Blocksy vulnerabilities

• creative themes blocksy companion WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability CVE-2026-65444 6.5 MediumOctober 30, 2026
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter CVE-2026-107645 9.1 CriticalOctober 10, 2026
• creative themes blocksy companion WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability CVE-2026-97247 6.5 MediumSeptember 30, 2026
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) CVE-2026-18488 6.4 MediumSeptember 1, 2026
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter CVE-2026-15158 9.8 CriticalJuly 9, 2026
• creative themes blocksy companion Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments CVE-2026-58480 Public exploit 9.2 CriticalJuly 8, 2026
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter CVE-2026-12430 4.4 MediumJune 19, 2026
• creativethemeshq blocksy Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field CVE-2026-8365 8.8 HighJune 9, 2026
• creativethemeshq blocksy Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields CVE-2026-2583 6.4 MediumMarch 2, 2026
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass CVE-2025-12846 8.8 HighNovember 11, 2025
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-12475 6.4 MediumOctober 30, 2025
• creativethemeshq blocksy companion Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode CVE-2025-9565 6.4 MediumSeptember 17, 2025
• creativethemeshq blocksy WordPress Blocksy Theme <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability CVE-2025-55713 5.9 MediumAugust 14, 2025
• creativethemeshq blocksy WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability CVE-2025-47465 4.9 MediumMay 7, 2025
• creativethemes blocksy WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-37469 5.4 MediumJanuary 2, 2025
• creativethemes blocksy Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11420 6.4 MediumDecember 5, 2024
• 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 MediumOctober 16, 2024
• creativethemes blocksy Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-5439 6.4 MediumJune 5, 2024
• creative themes blocksy companion WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability CVE-2024-35633 4.4 MediumJune 3, 2024
• creativethemes blocksy Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4943 6.4 MediumMay 21, 2024
• creativethemes blocksy companion Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads CVE-2024-4487 6.4 MediumMay 11, 2024
• creativethemes blocksy Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4158 6.4 MediumMay 9, 2024
• creativethemes blocksy Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block CVE-2024-3747 6.4 MediumMay 2, 2024
• creativethemes blocksy WordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerability CVE-2024-32961 6.5 MediumApril 25, 2024
• creativethemes blocksy WordPress Blocksy theme <= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31382 4.3 MediumApril 15, 2024
• creativethemes blocksy companion WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31932 5.4 MediumApril 11, 2024
• creativethemes blocksy companion Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2392 6.4 MediumMarch 22, 2024
• creativethemes blocksy Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1767 6.4 MediumMarch 9, 2024
• creativethemes blocksy WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability CVE-2024-24871 6.5 MediumFebruary 8, 2024
• creativethemes blocksy companion Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access CVE-2023-1911 4.3 MediumMay 2, 2023
• creativethemes blocksy companion WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23898 5.5 MediumApril 6, 2023