Vulnerabilities

TI-2024-23502 CVE-2024-35633 · GHSA-cgc3-wxqq-7x44

WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability

LOW 22

Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0026 Published 2024-06-03 No fix listed CWE-918

TI-2024-04174 CVE-2024-4487 · GHSA-9mgf-hh2m-346c

Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads

LOW 29

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00429 Published 2024-05-11 No fix listed CWE-79

TI-2024-21035 CVE-2024-31932 · GHSA-4hm5-5hxv-2486

WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.28.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00208 Published 2024-04-11 No fix listed CWE-352

TI-2024-02222 CVE-2024-2392 · GHSA-vq44-9mcp-gv3x

Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00343 Published 2024-03-22 No fix listed CWE-79

TI-2023-01796 CVE-2023-1911 · GHSA-v7cp-3qx6-ff4r

Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access

MEDIUM 53

The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft po…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0055 Published 2023-05-02 Fixed in 1.8.82 CWE-639

TI-2023-09697 CVE-2023-23898 · GHSA-6w6v-rfwc-h24p

WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)

LOW 25

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeThemes Blocksy Companion plugin <= 1.8.67 versions.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00341 Published 2023-04-06 No fix listed CWE-79