CVE-2026-12430 describes a stored Cross-Site Scripting vulnerability in the Blocksy Companion plugin for WordPress, affecting versions up to 2.1.45. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with editor or higher permissions to inject arbitrary scripts via admin settings. This vulnerability is limited to multi-site WordPress setups or installations with unfiltered_html disabled, and the injected scripts execute when users visit the affected pages. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with editor-level or higher privileges can inject persistent malicious scripts into pages via admin settings. These scripts execute in the context of users visiting the affected pages, potentially leading to partial disclosure of confidential information and alteration of data integrity. The vulnerability does not impact availability. The attack requires high privileges and affects multi-site or restricted unfiltered_html environments only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict editor-level permissions to trusted users only in multi-site or unfiltered_html-disabled installations. Monitor official vendor channels for updates or patches addressing this vulnerability.