CVE-2026-107645 is a critical vulnerability in the Blocksy Companion plugin for WordPress, allowing unauthenticated attackers to escalate privileges to a Dokan 'seller' account and gain elevated publishing capabilities. This vulnerability affects WordPress site administrators and security teams, who should assess exposure and prioritize remediation. The vulnerability has a high CVSS score of 9.1, indicati [truncated]
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. T [truncated]
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '<' or '>' and does not prevent serialized PHP object stri [truncated]
