The Blocksy Companion plugin for WordPress versions up to 2.0.45 suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, SVG uploads are not adequately sanitized or escaped, enabling authenticated users with contributor or higher privileges to embed arbitrary JavaScript code. This code executes in the context of any user who accesses the infected page, potentially leading to session hijacking or other script-based attacks. The vulnerability is tracked as CVE-2024-4487 with a CVSS 3.1 base score of 6.4, reflecting a medium severity level. No patch or official fix has been documented in the provided data.

An attacker with contributor-level or higher permissions can inject malicious scripts via SVG uploads that persist on the site and execute in the browsers of users who visit the compromised pages. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side impacts typical of stored XSS vulnerabilities. There is no indication of direct impact on server availability or integrity beyond the script injection. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling SVG uploads if possible. Monitor for plugin updates from creativethemeshq addressing this vulnerability.