Plugin icon

Blocksy Companion

blocksy-companion

Vulnerabilities:

11

Last Updated:

March 26, 2026

Active Installs:

300000

Published
Title
Fixed in
CVSS
Published
2025-11-10
Title
Blocksy Companion < 2.1.20 - Author+ Arbitrary File Upload via SVG Upload Bypass
Fixed in
Fixed in 2.1.20
CVSS
7.2 (high)
Published
2025-10-06
Title
Blocksy Companion < 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.1.15
CVSS
6.4 (medium)
Published
2025-09-16
Title
Blocksy Companion < 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
Fixed in
Fixed in 2.1.11
CVSS
6.4 (medium)
Published
2024-05-30
Title
Blocksy Companion < 2.0.43 - Authenticated (Admin+) Server-Side Request Forgery
Fixed in
Fixed in 2.0.43
CVSS
5.5 (medium)
Published
2024-05-10
Title
Blocksy Companion < 2.0.46 - Contributor+ Stored Cross-Site Scripting via SVG Uploads
Fixed in
Fixed in 2.0.46
CVSS
6.4 (medium)
Published
2024-04-10
Title
Blocksy Companion < 2.0.29 - Cross-Site Request Forgery
Fixed in
Fixed in 2.0.29
CVSS
5.3 (medium)
Published
2024-03-21
Title
Blocksy Companion < 2.0.32 - Contributor+ Stored XSS
Fixed in
Fixed in 2.0.32
CVSS
6.5 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.8.47
CVSS
6.1 (medium)
Published
2023-04-10
Title
Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
Fixed in
Fixed in 1.8.82
CVSS
6.5 (medium)
Published
2023-01-27
Title
Blocksy Companion < 1.8.68 - Contributor+ Stored XSS
Fixed in
Fixed in 1.8.68
CVSS
6.8 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 1.8.20
CVSS
4.3 (medium)