Advisories · Technology
creativethemeshq Blocksy Companion.
Every CVE that names creativethemeshq Blocksy Companion among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
- creativethemeshq Blocksy Companion
- Privilege escalation
- CVSS 6.4 Medium
Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
- creativethemeshq Blocksy Companion
- Unrestricted file upload
- CVSS 4.4 Medium
Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 8.8 High
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
- creativethemeshq Blocksy Companion
- Unrestricted file upload
- CVSS 6.4 Medium
Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)