Creative Themes Blocksy Companion vulnerabilities

3 vulnerabilities

Known vulnerabilities in Creative Themes Blocksy Companion, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.5CVE-2024-35633creative themesblocksy companion+2
EPSS score
0.26%
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.9.8CVE-2026-58480creative themesblocksy companion
EPSS score
3.57%
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.6.5CVE-2026-97247creative themesblocksy companion+1
EPSS score
0.21%
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.