CVE Intelligence

Creative Themes Blocksy Companion vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Creative Themes Blocksy Companion: 2 record(s), with affected versions and fixes.

CVE-2026-97247 Medium · 6.5 CWE-862 Sep 30, 2026
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
CVE-2026-58480 Critical · 9.8 CWE-434 Jul 8, 2026
Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.