CVE-2025-9565

🗓️ 17 Sep 2025 06:17:48Reported by WordfenceType

Blocksy Companion plugin stores XSS via the blocksy_newsletter_subscribe shortcode and versions up to 2.1.10; contributor access required.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-9565	17 Sep 202509:30	–	circl
CNNVD	WordPress plugin Blocksy Companion 跨站脚本漏洞	17 Sep 202500:00	–	cnnvd
CNVD	WordPress Blocksy Companion Plugin Cross-Site Scripting Vulnerability	19 Sep 202500:00	–	cnvd
Cvelist	CVE-2025-9565 Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode	17 Sep 202506:17	–	cvelist
EUVD	EUVD-2025-29692	3 Oct 202520:07	–	euvd
NVD	CVE-2025-9565	17 Sep 202507:15	–	nvd
Patchstack	WordPress Blocksy Companion plugin <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode vulnerability	16 Sep 202522:52	–	patchstack
Positive Technologies	PT-2025-38124	17 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-9565	19 Sep 202506:25	–	redhatcve
Vulnrichment	CVE-2025-9565 Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode	17 Sep 202506:17	–	vulnrichment

Vulners

Node

creativethemeshq blocksy_companionRange≤2.1.10wordpress

[
  {
    "vendor": "creativethemeshq",
    "product": "Blocksy Companion",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.1.10",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.9/framework/extensions/newsletter-subscribe/helpers.php
plugins	www.plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.9/framework/extensions/newsletter-subscribe/extension.php
wordpress	www.wordpress.org/plugins/blocksy-companion/
plugins	www.plugins.trac.wordpress.org/changeset/3360000/blocksy-companion/trunk/framework/extensions/newsletter-subscribe/helpers.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c28e740e-9337-41b5-a8e7-ca68e41eaed4