CVE-2026-12430 is a stored cross-site scripting vulnerability in the Blocksy Companion WordPress plugin (creativethemeshq) affecting versions up to 2.1.45. The vulnerability is due to improper neutralization of input during web page generation, allowing authenticated users with editor or higher privileges to inject arbitrary scripts via admin settings. The vulnerability manifests only in multi-site WordPress environments or where unfiltered_html is disabled, enabling script execution in pages viewed by other users.

An attacker with editor-level or higher permissions can inject malicious scripts that execute in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. The CVSS 3.1 base score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, administrators should restrict editor-level permissions carefully and consider disabling multi-site installations or enabling unfiltered_html capability where appropriate as temporary mitigations. Monitor vendor channels for updates and apply official patches once available.