Creativethemeshq vulnerabilities
We track 5 vulnerabilities in Creativethemeshq products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest Creativethemeshq vulnerabilities
- 9.1 Critical severity
Blocksy Companion: Improper Privilege Management
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter
- 9.8 Critical severity
Blocksy Companion: Unrestricted Upload of File with Dangerous Type
The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that appr
- 8.8 High severity
Blocksy: Deserialization of Untrusted Data
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization
- 8.8 High severity
Blocksy Companion: Unrestricted Upload of File with Dangerous Type
The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass saniti
- 8.8 High severity
Blocksy: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through <= 2.0.22.