Blocksy

Blocksy has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (57%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Input Validation.

Every one of the 14 issues recorded for Blocksy has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (5) reported by Ngô Thiên An (ancorn_). Blocksy is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

5.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Blocksy vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-8365

Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field

Read the full analysis

Vulnerability Records

14 records


2026-06-08 20:11	Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field Blocksy <= 2.1.41	`CVE-2026-8365`	8.8 High	Quốc Huy (jtwings)	Yes
2026-03-02 09:26	Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields Blocksy <= 2.1.30	`CVE-2026-2583`	6.4 Medium	Quốc Huy (jtwings)	Yes
2025-08-14 00:00	Blocksy <= 2.1.6 - Authenticated (Shop manager+) Stored Cross-Site Scripting Blocksy <= 2.1.6	`CVE-2025-55713`	5.5 Medium	SavPhill (Savphill)	Yes
2025-05-07 00:00	Blocksy <= 2.0.97 - Missing Authorization Blocksy <= 2.0.97	`CVE-2025-47465`	2.7 Low	SavPhill (Savphill)	Yes
2024-12-04 00:00	Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting Blocksy <= 2.0.77	`CVE-2024-11420`	6.4 Medium	zer0gh0st	Yes
2024-07-01 00:00	Blocksy <= 2.0.22 - Cross-Site Request Forgery Blocksy <= 2.0.22	`CVE-2024-37469`	4.3 Medium	RE-ALTER	Yes
2024-06-04 19:06	Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting Blocksy <= 2.0.50	`CVE-2024-5439`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes
2024-05-20 14:17	Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting Blocksy <= 2.0.46	`CVE-2024-4943`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes
2024-05-03 00:00	Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting Blocksy <= 2.0.42	`CVE-2024-4158`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes
2024-04-24 00:00	Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block Blocksy <= 2.0.39	`CVE-2024-3747`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes

Showing 1–10 of 14 reports

Latestv2.1.57

Blocksy

Author

Creative Themes

5.0(872)

100/100

Last Updated

2026-09-11 (2d ago)

Active Installs

300,000+

Downloads

7,790,896

Requires WP

6.7+

Requires PHP

7.0+

Created

2019-05-10 (7y ago)

Blocksy is a fast, modern WordPress theme with advanced WooCommerce support and full compatibility with the block editor.