Vulnerabilidades do Creative Themes Blocksy Companion
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Creative Themes Blocksy Companion: 2 registro(s), com versões afetadas e correções.
CVE-2026-97247
Média · 6.5
CWE-862 30/09/2026
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
CVE-2026-58480
Crítica · 9.8
CWE-434 08/07/2026
Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.