Skip to content
OpenAdvisories

Vendor

creativethemeshq

23 known vulnerabilities.

Products

Blocksy 14 Blocksy Companion 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-107645

    Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

    The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filte…

    creativethemeshq Blocksy Companion Web / CMS
  • Critical 9.8
    CVE-2026-15158

    Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

    The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that app…

    creativethemeshq Blocksy Companion Web / CMS