creativethemeshq vulnerabilities

CVEs per yearBy the year they were published

1. 202412
2. 20256
3. 20266

Newest CVEs

• CVE-2026-107645

  Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

  creativethemeshq · Blocksy Companion

  Critical9.1
• CVE-2026-18488

  Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

  creativethemeshq · Blocksy Companion

  Medium6.4
• CVE-2026-15158

  Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

  creativethemeshq · Blocksy Companion

  Critical9.8
• CVE-2026-12430

  Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter

  creativethemeshq · Blocksy Companion

  Medium4.4
• CVE-2026-8365

  Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field

  creativethemeshq · Blocksy

  High8.8
• CVE-2026-2583

  Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields

  creativethemeshq · Blocksy

  Medium6.4
• CVE-2025-12846

  Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass

  creativethemeshq · Blocksy Companion

  High8.8
• CVE-2025-12475

  Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

  creativethemeshq · Blocksy Companion

  Medium6.4
• CVE-2025-9565

  Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode

  creativethemeshq · Blocksy Companion

  Medium6.4
• CVE-2025-55713

  WordPress Blocksy Theme <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

  creativethemeshq · Blocksy

  Medium5.9