---
title: "Blocksy theme and Blocksy Companion vulnerabilities since 2020"
description: "The 14 Blocksy theme vulnerabilities since 2020, those in Blocksy Companion and the critical Companion Pro flaws of 2026, with the safe versions."
language: "en"
locale: "en-US"
type: "article"
canonical: "https://www.wp-masquerade.com/blocksy-theme-security-vulnerabilities/"
published: "2026-07-14T07:00:00+00:00"
modified: "2026-10-29T07:36:40+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/blocksy-theme-security-vulnerabilities/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/failles-securite-theme-blocksy/index.md"
  es-ES: "https://www.wp-masquerade.com/es/vulnerabilidades-tema-blocksy/index.md"
  de-DE: "https://www.wp-masquerade.com/de/blocksy-theme-sicherheitsluecken/index.md"
  it-IT: "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-tema-blocksy/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-tema-blocksy/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/blocksy-thema-kwetsbaarheden-beveiliging/index.md"
---

# Blocksy theme and Blocksy Companion vulnerabilities since 2020

The Blocksy theme had no vulnerability before 2024, then fourteen, including a PHP object injection in June 2026. Its Companion Pro plugin had three critical vulnerabilities in spring 2026.

Blocksy had no published vulnerability before 2024, then fourteen in two and a half years according to Patchstack, including a [PHP object injection](https://www.wp-masquerade.com/glossary/insecure-deserialization/) in June 2026. Its companion plugin, Blocksy Companion, has its own history, and its paid version went through a series of critical vulnerabilities in spring 2026, up to unauthenticated code execution. Here is the complete timeline, what each vulnerability allowed and the versions to install.

## Blocksy in brief

Blocksy is a free theme published by Creative Themes, released on wordpress.org in May 2019. It has more than 300,000 active installations (wordpress.org) and presents itself as a fast theme, compatible with the block editor and strongly geared toward WooCommerce. It provides its own blocks (About Me, Contact Info, etc.) and per-content options, stored in a field named `blocksy_meta`.

Most advanced features go through a separate plugin: Blocksy Companion, free and also installed on more than 300,000 sites, which adds starter sites, WooCommerce extensions and other modules. The paid version, Blocksy Companion Pro, is distributed by the vendor. The three components have separate histories: this article covers them in distinct sections. We explained in [our article on popular themes with few vulnerabilities](https://www.wp-masquerade.com/popular-wordpress-themes-security-vulnerabilities/) why a theme usually contains few vulnerabilities; Blocksy shows that a theme that ships blocks and fields saved through the REST API is more exposed.

## Timeline of Blocksy vulnerabilities from 2020 to July 2026

![Timeline: February 28, 2022, Blocksy Companion, unauthorized AJAX calls via Freemius, fixed in 1.8.20; April 10, 2023, Blocksy Companion, drafts readable by a subscriber, fixed in 1.8.82; February 5, 2024, the theme's first published vulnerability, an XSS fixed in 2.0.20; March to June 2024, six contributor XSS in the theme's blocks, fixed from 2.0.27 to 2.0.51; December 4, 2024, XSS in the Contact Info block, fixed in 2.0.78; November 10, 2025, Blocksy Companion, executable file disguised as an SVG uploaded by an author, fixed in 2.1.20; March 2, 2026, XSS via the blocksy_meta fields, fixed in 2.1.31; April 8, 2026, Blocksy Companion Pro, unauthenticated SQL injection, fixed in 2.1.29; April 22, 2026, Blocksy Companion Pro, code executed by a contributor, fixed in 2.1.38; June 8, 2026, PHP object injection in the theme via the REST API, fixed in 2.1.42; June 29, 2026, Blocksy Companion Pro, unauthenticated code execution, fixed in 2.1.47.](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-blocksy-en.webp)

*The notable vulnerabilities of the Blocksy theme and its Companion and Companion Pro plugins.*

The following table lists the theme's fourteen vulnerabilities recorded by Patchstack, with the Patchstack publication date and the [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) from the authority that assigned the [CVE](https://www.wp-masquerade.com/glossary/cve/) (CNA). WPScan lists only twelve: the two cross-site request forgeries (CSRF) are missing. None is documented as exploited by a recognized source.

| Published | Fixed in | Type | CVSS | CVE | Account required |
| --- | --- | --- | --- | --- | --- |
| February 5, 2024 | 2.0.20 | Stored XSS | 6.5 | CVE-2024-24871 | Editor (according to WPScan) |
| March 11, 2024 | 2.0.27 | Stored XSS via block attributes | 6.4 | CVE-2024-1767 | Contributor |
| April 10, 2024 | 2.0.23 | Cross-site request forgery (CSRF) | 4.3 | CVE-2024-31382 | None (a logged-in user must click) |
| April 23, 2024 | 2.0.34 | Stored XSS | 6.5 | CVE-2024-32961 | Contributor |
| April 25, 2024 | 2.0.40 | Stored XSS (About Me block) | 6.4 | CVE-2024-3747 | Contributor |
| May 5, 2024 | 2.0.43 | Stored XSS (tagName parameter) | 6.4 | CVE-2024-4158 | Contributor |
| May 21, 2024 | 2.0.47 | Stored XSS (link rel attribute) | 6.4 | CVE-2024-4943 | Contributor |
| June 5, 2024 | 2.0.51 | XSS (custom_url parameter) | 6.4 | CVE-2024-5439 | Contributor |
| July 1, 2024 | 2.0.23 | Cross-site request forgery (CSRF) | 5.4 | CVE-2024-37469 | None (a logged-in user must click) |
| December 4, 2024 | 2.0.78 | Stored XSS (Contact Info block) | 6.4 | CVE-2024-11420 | Contributor |
| May 7, 2025 | 2.0.98 | Missing authorization check | 4.9 | CVE-2025-47465 | High-privilege account |
| August 14, 2025 | 2.1.7 | Stored XSS | 5.9 | CVE-2025-55713 | Shop manager (according to WPScan) |
| March 2, 2026 | 2.1.31 | Stored XSS via the blocksy_meta fields | 6.4 | CVE-2026-2583 | Contributor |
| June 8, 2026 | 2.1.42 | PHP object injection (REST API and migration) | 8.8 | CVE-2026-8365 | Contributor |

*Blocksy theme: the 14 vulnerabilities published by Patchstack from January 1, 2020 to July 11, 2026.*

![Bar chart of Blocksy theme vulnerabilities published per year according to Patchstack: none from 2020 to 2023, 10 in 2024 all medium, 2 medium in 2025, 2 in 2026 up to July 11 including 1 high; 14 in total.](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-blocksy-en.webp)

*Patchstack database, January 1, 2020 to July 11, 2026; severity according to the CNA. Blocksy Companion is not counted.*

## The theme's notable vulnerabilities explained

### 2024: a string of XSS in the blocks

Ten of the fourteen vulnerabilities date from 2024, almost all stored XSS. The pattern repeats: a theme block accepts an attribute (`className`, `radius`, `tagName`, the Contact Info block link) and displays it again without escaping it. A contributor can then slip in JavaScript, which runs for every visitor to the page, including an administrator. Researcher Ngô Thiên An reported five of them to Wordfence between March and June 2024, fixed over versions 2.0.27 to 2.0.51. These vulnerabilities require an account that can write posts: they mostly concern multi-author sites. The mechanism is detailed in our article on XSS vulnerabilities.

### Two request forgeries fixed in 2.0.23

Patchstack published two CSRF vulnerabilities in April and then July 2024 affecting versions up to 2.0.22 (CVE-2024-31382 and CVE-2024-37469). An attacker without an account could prepare a page that, when opened by a logged-in user, triggered an action without their knowledge. The scores remain moderate (4.3 and 5.4), and version 2.0.23 fixes both.

### June 2026: the PHP object injection

The theme's most serious vulnerability, CVE-2026-8365 (8.8 according to Wordfence), combines two flaws. First, the function that sanitizes the `blocksy_meta` options, which can be changed through the REST API, only blocked the `<` and `>` characters: a contributor could save a serialized PHP string in them. Second, a database migration run during a theme update unserialized all values without class restrictions. The injected object then triggered a call to an arbitrary PHP function, and therefore code execution. Researcher Quốc Huy, who had also found the March 2026 XSS in the same fields, reported it on May 12, 2026; it was published on June 8 and fixed in 2.1.42. To understand this type of attack, see [our article on PHP deserialization](https://www.wp-masquerade.com/php-deserialization-object-injection/) and the one on [REST API security](https://www.wp-masquerade.com/wordpress-rest-api-security/).

## Blocksy Companion: the companion plugin

This section is about the free Blocksy Companion plugin, not the theme. WPScan attributes 12 vulnerabilities published from January 1, 2020 to July 11, 2026 to it, almost all of medium severity:

| Published | Fixed in | Type | CVSS | CVE | Account required |
| --- | --- | --- | --- | --- | --- |
| February 28, 2022 | 1.8.20 | Unauthorized AJAX calls via the Freemius SDK | 6.3 (Freemius SDK CVE) | CVE-2022-4974 | Logged-in account |
| January 27, 2023 | 1.8.68 | Stored XSS | 5.5 | CVE-2023-23898 | Contributor |
| April 10, 2023 | 1.8.82 | Reading drafts via a shortcode | 4.3 (CISA-ADP) | CVE-2023-1911 | Subscriber |
| March 21, 2024 | 2.0.32 | Stored XSS (Newsletter widget) | 6.4 | CVE-2024-2392 | Contributor |
| April 10, 2024 | 2.0.29 | Cross-site request forgery (CSRF) | 5.4 | CVE-2024-31932 | None (a user must click) |
| May 10, 2024 | 2.0.46 | XSS via SVG image upload | 6.4 | CVE-2024-4487 | Contributor |
| May 30, 2024 | 2.0.43 | Server-side request forgery (SSRF) | 4.4 | CVE-2024-35633 | Administrator |
| September 16, 2025 | 2.1.11 | Stored XSS (newsletter subscribe shortcode) | 6.4 | CVE-2025-9565 | Contributor |
| October 6, 2025 | 2.1.15 | Stored XSS | 6.4 | CVE-2025-12475 | Contributor |
| November 10, 2025 | 2.1.20 | Arbitrary file upload (fake SVG) | 8.8 | CVE-2025-12846 | Author |
| June 18, 2026 | 2.1.46 | Stored XSS (product description) | 4.4 | CVE-2026-12430 | Editor |

*Blocksy Companion (free): 11 of the 12 vulnerabilities published by WPScan from January 1, 2020 to July 11, 2026; the twelfth, a reflected XSS in the Freemius SDK fixed in July 2023, has no verifiable CVE.*

The free plugin's most severe vulnerability is CVE-2025-12846. Blocksy Companion allows SVG image uploads, but its file type check could be fooled by a double extension: an author could upload a file accepted as an SVG but executable by the server, which made code execution possible. Angus Girvan found it on October 30, 2025 and reported it on November 6; version 2.1.20 came out on November 7, and the vulnerability was published on November 10. The fix took a few days.

## Blocksy Companion Pro: five vulnerabilities in three months

The paid version only concerns Creative Themes customers. Patchstack published five vulnerabilities in it between April and June 2026, three of them critical:

- **April 8, 2026**: unauthenticated SQL injection, versions before 2.1.29 (CVE-2026-39596, 9.3).
- **April 22, 2026**: code execution by a contributor, up to 2.1.37, fixed in 2.1.38 (CVE-2026-40783, 9.9).
- **June 26, 2026**: a second code execution by a contributor, up to 2.1.45 (CVE-2026-57315, 8.5), and an unprotected direct object reference, without an account (CVE-2026-57630, 5.3).
- **June 29, 2026**: unauthenticated code execution, up to 2.1.46, fixed in 2.1.47 (CVE-2026-57624, 10).

The last one is the most dangerous. The same researcher, Nguyen Ba Khanh, also appears in two other records published in early July for the same versions: CVE-2026-15158 at Wordfence (9.8) and CVE-2026-58480 at VulnCheck (9.8), which seem to describe the same flaw. According to Wordfence, the function that saved photos attached to customer reviews (Advanced Reviews module) relied on a filter from the Custom Fonts module that accepted any file name containing `.woff2` or `.ttf`, anywhere in the name.

A file named `shell.woff2.php` therefore passed the check and could be executed as PHP. Wordfence specifies that the vulnerability is only exploitable with the Pro version, when the WooCommerce Extra (Advanced Reviews) and Custom Fonts modules are both active; the free plugin does not contain this code, even though Patchstack lists it too. Wordfence notified the vendor on June 24, 2026 and published its record on July 1.

None of these vulnerabilities is documented as exploited by a recognized source as of July 11, 2026. But unauthenticated code execution on a WooCommerce store is exactly the kind of vulnerability bots exploit quickly: the update should not wait.

## What this history shows

- **A theme that does more than display content is more exposed**: Blocksy's vulnerabilities come from its blocks and from its fields saved through the REST API, not from its templates.
- **The contributor remains the main entry point**: twelve of the theme's fourteen vulnerabilities require an account, most often a contributor.
- **File upload, the most dangerous vulnerability**: a fake SVG in Companion in 2025, a fake font file in Companion Pro in 2026. Checks based on file name extensions are fragile.
- **Quick fixes when the dates are known**: Companion's SVG vulnerability was fixed the day after it was reported to the vendor.

WordPress core also follows a regular rhythm of security releases, traced in [our timeline of WordPress core vulnerabilities](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/).

## How to protect your site

- **Update** the Blocksy theme (at least 2.1.42), Blocksy Companion (at least 2.1.46) and Blocksy Companion Pro (at least 2.1.47), ideally to the latest version. The Pro version is distributed by Creative Themes: check that it actually receives updates.
- **Turn on automatic updates** at least for minor releases (our guide to automatic updates).
- **Disable unused Companion modules**: the critical June 2026 vulnerability required two active modules. Delete the plugins and themes you no longer use (see abandoned plugins).
- **Limit contributor and author accounts**, and close registration if you do not need it (see roles and least privilege).
- **Block PHP execution** in `/wp-content/uploads/` at the server level, and look for any suspicious `.php` file there.
- **Add a web application firewall** to cover the gap between a disclosure and your update (our WordPress firewall comparison), and **watch the advisories** that concern your components (our method).

WP Masquerade Pro helps you not miss an advisory, for themes as well as plugins. Every day, it compares the installed versions with the public WPVulnerability.net database and sends a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/) with the severity and the fixed version; the member area shows [pending updates and vulnerable sites](https://www.wp-masquerade.com/features/#surveillance). WP Masquerade alerts: it does not fix Blocksy and it is not a firewall, so updating remains essential. For a firewall, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/).

### Key takeaways

- Patchstack lists 14 vulnerabilities in the Blocksy theme from January 1, 2020 to July 11, 2026, all since 2024, one of them high: the PHP object injection fixed in 2.1.42.
- The free Blocksy Companion plugin has 12 vulnerabilities in WPScan over the same period, including a file upload by an author fixed in 2.1.20.
- Blocksy Companion Pro had three critical vulnerabilities in spring 2026, including unauthenticated code execution fixed in 2.1.47.
- No documented exploitation to date; minimum versions: theme 2.1.42, Companion 2.1.46, Companion Pro 2.1.47.

## Sources

- WordPress.org: Blocksy, theme page and active installations (https://wordpress.org/themes/blocksy/)
- WordPress.org: Blocksy Companion, plugin page (https://wordpress.org/plugins/blocksy-companion/)
- CVE.org: CVE-2024-31382, Blocksy, CSRF (April 15, 2024) (https://www.cve.org/CVERecord?id=CVE-2024-31382)
- CVE.org: CVE-2024-37469, Blocksy, CSRF (January 2, 2025) (https://www.cve.org/CVERecord?id=CVE-2024-37469)

Other sources consulted: further CVE records, WPScan and Patchstack databases.

**Update, October 28, 2026:** on October 9, 2026, Wordfence disclosed CVE-2026-107645 (rated 9.1) in Blocksy Companion up to 2.1.58: on stores that also use Dokan, an unauthenticated visitor could create a vendor account. Version 2.1.59 fixes it. Full details: [Blocksy Companion vulnerability: Dokan vendor with no account](https://www.wp-masquerade.com/blocksy-companion-vulnerability-cve-2026-107645/).