PT-2026-50838 · Creativethemes · Blocksy Companion

Pasindu Dilshan

·

Publicado

2026-06-19

·

Atualizado

2026-06-19

·

CVE-2026-12430

CVSS v3.1

4.4

Média

VetorAV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered html has been disabled.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-12430

Produtos afetados

Blocksy Companion