SZB-663e276a67
Blocksy Companion stored XSS flaw affects versions through 2.1.60 (EUVD-2026-114002)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Creative Themes
- Product
- Blocksy Companion
- First seen
Summary
The EUVD record, updated October 30, 2026, rates this stored cross-site scripting flaw 6.5/10 (CVSS v3.1). It affects Blocksy Companion from the first release through version 2.1.60.
If you use Creative Themes
Update Blocksy Companion to a version later than 2.1.60
Review site content and user input for injected scripts
Limit editor and contributor roles to trusted users
What the sources say 1
· Mastodon: “Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.” Source