Creative Themes vulnerabilities and threats

8 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.5	EPSS 0.2%	CVE-2026-97247Blocksy Companion (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97247 Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. EPSS 0.2%Vulnerability Creative Themes CWE-862	CVE Database V5	2026-09-30
Critical	9.2	EPSS 3.6%	CVE-2026-58480Blocksy Companion (WordPress plugin) · Unrestricted File Upload Critical9.2EPSS 3.6%2026-07-08CVE Database V5CVE-2026-58480 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution. EPSS 3.6%Vulnerability Creative Themes CWE-434	CVE Database V5	2026-07-08
Critical	10.0	EPSS 0.9%	CVE-2026-57624Blocksy Companion Pro (WordPress plugin) · Code Injection Critical10.0EPSS 0.9%2026-07-02CVE Database V5CVE-2026-57624 Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. EPSS 0.9%Vulnerability Creative Themes CWE-94	CVE Database V5	2026-07-02
Medium	5.3	EPSS 0.3%	CVE-2026-57630Blocksy Companion Pro (WordPress plugin) · Insecure Direct Object Reference Medium5.3EPSS 0.3%2026-06-26CVE Database V5CVE-2026-57630 Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions. EPSS 0.3%Vulnerability Creative Themes CWE-639	CVE Database V5	2026-06-26
High	8.5	EPSS 0.6%	CVE-2026-57315Blocksy Companion Pro (WordPress plugin) · Code Injection High8.5EPSS 0.6%2026-06-26CVE Database V5CVE-2026-57315 Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions. EPSS 0.6%Vulnerability Creative Themes CWE-94	CVE Database V5	2026-06-26
Critical	9.9	EPSS 0.5%	CVE-2026-40783Blocksy Companion Pro (WordPress plugin) · Code Injection Critical9.9EPSS 0.5%2026-06-17CVE Database V5CVE-2026-40783 Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. EPSS 0.5%Vulnerability Creative Themes CWE-94	CVE Database V5	2026-06-17
Critical	9.3	EPSS 0.4%	CVE-2026-39596Blocksy Companion Pro (WordPress plugin) · SQL Injection Critical9.3EPSS 0.4%2026-06-17CVE Database V5CVE-2026-39596 Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. EPSS 0.4%Vulnerability Creative Themes CWE-89	CVE Database V5	2026-06-17
Medium	4.4	EPSS 0.3%	CVE-2024-35633Blocksy Companion (WordPress plugin) · Server-Side Request Forgery (SSRF) Medium4.4EPSS 0.3%2024-06-03CVE Database V5CVE-2024-35633 Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42. EPSS 0.3%Vulnerability Creative Themes	CVE Database V5	2024-06-03

Page 1 of 1