Creative Themes vulnerabilities

8 vulnerabilities

Known vulnerabilities in Creative Themes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.

Products

2
5.5CVE-2024-35633creative themesblocksy companion+2
EPSS score
0.26%
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.9.9CVE-2026-40783creative themesblocksy companion pro+1
EPSS score
0.79%
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.9.3CVE-2026-39596creative themesblocksy companion pro+1
EPSS score
0.40%
Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.9.8CVE-2026-58480creative themesblocksy companion
EPSS score
3.57%
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.10CVE-2026-57624creative themesblocksy companion pro+1
EPSS score
0.86%
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.5.3CVE-2026-57630creative themesblocksy companion pro+1
EPSS score
0.31%
Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.8.8CVE-2026-57315creative themesblocksy companion pro+1
EPSS score
0.58%
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.6.5CVE-2026-97247creative themesblocksy companion+1
EPSS score
0.21%
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.