Blocksy Companion

Blocksy Companion has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 13 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (54%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Authorization Bypass Through User-Controlled Key.

Every one of the 13 issues recorded for Blocksy Companion has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (2) reported by Rafshanzani Suhada. Blocksy Companion is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Blocksy Companion vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-15158

Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

Read the full analysis

Vulnerability Records

13 records


2026-08-31 17:21	Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) Blocksy Companion <= 2.1.51	`CVE-2026-18488`	6.4 Medium	haofanjiukunle	Yes
2026-07-01 13:28	Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter Blocksy Companion <= 2.1.46	`CVE-2026-15158`	9.8 Critical	Nguyen Ba Khanh	Yes
2026-06-18 15:44	Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter Blocksy Companion <= 2.1.45	`CVE-2026-12430`	4.4 Medium	Pasindu Dilshan (K4PXD)	Yes
2025-11-10 22:26	Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass Blocksy Companion <= 2.1.19	`CVE-2025-12846`	8.8 High	shark3y	Yes
2025-10-06 00:00	Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting Blocksy Companion <= 2.1.14	`CVE-2025-12475`	6.4 Medium	Rafshanzani Suhada	Yes
2025-09-16 17:33	Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode Blocksy Companion <= 2.1.10	`CVE-2025-9565`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-05-30 00:00	Blocksy Companion <= 2.0.42 - Authenticated (Admin+) Server-Side Request Forgery Blocksy Companion <= 2.0.42	`CVE-2024-35633`	5.5 Medium	Yuchen Ji	Yes
2024-05-10 00:00	Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads Blocksy Companion <= 2.0.45	`CVE-2024-4487`	6.4 Medium	wesley (wcraft)	Yes
2024-04-10 00:00	Blocksy Companion <= 2.0.28 - Cross-Site Request Forgery Blocksy Companion <= 2.0.28	`CVE-2024-31932`	5.3 Medium	R3N0	Yes
2024-03-21 00:00	Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting Blocksy Companion <= 2.0.31	`CVE-2024-2392`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes

Showing 1–10 of 13 reports

Latestv2.1.57

Blocksy Companion

Author

Creative Themes

4.7(93)

94/100

Last Updated

2026-09-10 (2d ago)

Active Installs

300,000+

Downloads

18,299,659

Requires WP

6.7+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2019-04-11 (8y ago)

Blocksy Companion is the official plugin that extends the power of the Blocksy WordPress theme. It unlocks extra features, premium integrations, and beautifully designed starter sites that help you build fast, modern, and fully customizable websites with ease. With Blocksy Companion, you get access to a growing library of starter sites, advanced WooCommerce enhancements, and exclusive extensions that take your website to the next level. Whether you’re creating a personal blog, a business website, or a professional online store, this plugin provides the tools you need to design stunning layouts and improve your workflow. Built for performance and flexibility, Blocksy Companion integrates seamlessly with popular WordPress plugins like WooCommerce, Elementor, Brizy, Beaver Builder, WPML and ACF. It gives you powerful customization options, dynamic features, and optimized code — all without slowing down your site. Key features: Starter Sites Library – import professionally designed demo sites with one click and kickstart your project. Extra Extensions – unlock advanced features such as Cookies Consent, Custom Code Snippets, Trending Posts, and more. WooCommerce Enhancements – boost your online store with additional customization options and modern layouts. Page Builder Ready – works perfectly with Elementor, Brizy, Beaver Builder, and other popular WordPress page builders. Advanced Integrations – seamless compatibility with Mailchimp, Rank Math, WPML, and other top WordPress plugins. Performance Focused – lightweight, fast, and optimized for speed to ensure a smooth user experience. Developer Friendly – clean, extendable codebase that makes customization and scaling easy. Minimum Requirements WordPress 5.0 or greater PHP version 7.0 or greater

View on WordPress.org