CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro Unauthenticated File Upload RCE Advanced Reviews → saveattachments → Custom Fonts strpos Bypass → shell.woff2.php Overview CVE-2026-58480 also tracked as CVE-2026-15158 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in Blocksy...

CVE-2026-107645

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

EUVD-2026-96038

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

CVE-2026-107645

The Blocksy Companion plugin for WordPress (versions up to and including 2.1.58 ) is vulnerable to an unauthenticated privilege escalation via the implement_user_registration() AJAX handler. The flaw exists because the plugin explicitly disables Dokan's vendor-registration nonce check and subsequ...

PT-2026-109475

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement user registration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via add filter'dokan register nonce check', ' return...

CVE-2026-107645: Improper Privilege Management

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

WordPress Blocksy Companion plugin <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter vulnerability

Unauthenticated Privilege Escalation to 'role' Parameter vulnerability discovered by Sawyer in WordPress Plugin Blocksy Companion versions = 2.1.58...

CVE-2026-97247

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-97247 WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

EUVD-2026-89911

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-97247 WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-97247

The Blocksy Companion WordPress plugin in versions

PT-2026-103243

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-97247: Missing Authorization

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Blocksy Companion versions = 2.1.55...

CVE-2026-18488

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488

The Blocksy Companion WordPress plugin (versions up to and including 2.1.51 ) is vulnerable to authenticated Stored XSS via the tagName block attribute in the blocksy/dynamic-data block, caused by insufficient input sanitization and output escaping. Attackers with Author-level access or higher ca...

EUVD-2026-68987

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...