Blocksy Companion vulnerabilities
3 known vulnerabilities in Blocksy Companion from Creativethemeshq. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
Blocksy Companion: Improper Privilege Management
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter
- 9.8 Critical severity
Blocksy Companion: Unrestricted Upload of File with Dangerous Type
The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that appr
- 8.8 High severity
Blocksy Companion: Unrestricted Upload of File with Dangerous Type
The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass saniti