Blocksy Vulnerabilities

The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which...

CVSS:

8.8

Affected:

up to 2.1.41

Fixed in:

2.1.42

Disclosed:

Jun 8, 2026

CVE-2026-8365 on NVD →

Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields vulnerability

CVSS:

6.5

Affected:

up to 2.1.30

Fixed in:

2.1.31

Disclosed:

Mar 2, 2026

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, and including, 2.1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inj...

CVSS:

6.4

Affected:

up to 2.1.30

Fixed in:

2.1.31

Disclosed:

Mar 2, 2026

CVE-2026-2583 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

5.5

Affected:

up to 2.1.6

Fixed in:

2.1.7

Disclosed:

Aug 14, 2025

CVE-2025-55713 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeThemes Blocksy allows Stored XSS. This issue affects Blocksy: from n/a through 2.1.6.

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Aug 14, 2025

CVE-2025-55713 on NVD →

The Blocksy theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_blocksy_notice_button_click AJAX endpoint in versions up to, and including, 2.0.97. This makes it possible for authenticated attackers, with administrator-level access and above, to install plugins. Thi...

CVSS:

2.7

Affected:

up to 2.0.97

Fixed in:

2.0.98

Disclosed:

May 7, 2025

CVE-2025-47465 on NVD →

[en] Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97.

Affected:

up to 2.0.98

Fixed in:

2.0.98

Disclosed:

May 7, 2025

CVE-2025-47465 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through 2.0.22.

Affected:

up to 2.0.23

Fixed in:

2.0.23

Disclosed:

Jan 2, 2025

CVE-2024-37469 on NVD →

[en] The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2.0.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above...

Affected:

up to 2.0.78

Fixed in:

2.0.78

Disclosed:

Dec 5, 2024

CVE-2024-11420 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2.0.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVSS:

6.4

Affected:

up to 2.0.77

Fixed in:

2.0.78

Disclosed:

Dec 4, 2024

CVE-2024-11420 on NVD →

The Blocksy theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.22. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a s...

CVSS:

4.3

Affected:

up to 2.0.22

Fixed in:

2.0.23

Disclosed:

Jul 1, 2024

CVE-2024-37469 on NVD →

[en] The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex...

Affected:

up to 2.0.51

Fixed in:

2.0.51

Disclosed:

Jun 5, 2024

CVE-2024-5439 on NVD →

The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.4

Affected:

up to 2.0.50

Fixed in:

2.0.51

Disclosed:

Jun 4, 2024

CVE-2024-5439 on NVD →

[en] The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in all versions up to, and including, 2.0.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t...

Affected:

up to 2.0.47

Fixed in:

2.0.47

Disclosed:

May 21, 2024

CVE-2024-4943 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in all versions up to, and including, 2.0.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inj...

CVSS:

6.4

Affected:

up to 2.0.46

Fixed in:

2.0.47

Disclosed:

May 20, 2024

CVE-2024-4943 on NVD →

[en] The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 2.0.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject a...

Affected:

up to 2.0.43

Fixed in:

2.0.43

Disclosed:

May 9, 2024

CVE-2024-4158 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 2.0.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitr...

CVSS:

6.4

Affected:

up to 2.0.42

Fixed in:

2.0.43

Disclosed:

May 3, 2024

CVE-2024-4158 on NVD →

[en] The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and abo...

Affected:

up to 2.0.40

Fixed in:

2.0.40

Disclosed:

May 2, 2024

CVE-2024-3747 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes HQ Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.33.

Affected:

up to 2.0.34

Fixed in:

2.0.34

Disclosed:

Apr 25, 2024

CVE-2024-32961 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, t...

CVSS:

6.4

Affected:

up to 2.0.39

Fixed in:

2.0.40

Disclosed:

Apr 24, 2024

CVE-2024-3747 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 2.0.33

Fixed in:

2.0.34

Disclosed:

Apr 23, 2024

CVE-2024-32961 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Creative Themes HQ Blocksy.This issue affects Blocksy: from n/a through 2.0.22.

Affected:

up to 2.0.23

Fixed in:

2.0.23

Disclosed:

Apr 15, 2024

CVE-2024-31382 on NVD →

The Blocksy theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.22. This is due to missing or incorrect nonce validation on the wp_ajax_blocksy_notice_button_click ajax action. This makes it possible for unauthenticated attackers to dismiss notices via a forged request...

CVSS:

4.3

Affected:

up to 2.0.22

Fixed in:

2.0.23

Disclosed:

Apr 10, 2024

CVE-2024-31382 on NVD →

[en] The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for authenticated attackers...

Affected:

up to 2.0.27

Fixed in:

2.0.27

Disclosed:

Mar 9, 2024

CVE-2024-1767 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for authenticated attackers with...

CVSS:

6.4

Affected:

up to 2.0.26

Fixed in:

2.0.27

Disclosed:

Mar 8, 2024

CVE-2024-1767 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.19.

Affected:

up to 2.0.20

Fixed in:

2.0.20

Disclosed:

Feb 8, 2024

CVE-2024-24871 on NVD →

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via headers/footers in all versions up to, and including, 2.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages...

CVSS:

4.4

Affected:

up to 2.0.19

Fixed in:

2.0.20

Disclosed:

Feb 5, 2024

CVE-2024-24871 on NVD →