{"id":"CVE-2026-65444","kind":"vulnerability","aliases":["CVE-2026-65444"],"related":[],"title":"Blocksy Companion WordPress plugin: stored cross-site scripting through versions 2.1.60","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.","summary":"Blocksy Companion, a WordPress plugin from Creative Themes, has a stored cross-site scripting flaw in versions through 2.1.60. An attacker can plant script that runs in the browser of whoever views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blocksy-companion","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Blocksy Companion version in the WordPress admin plugins list or the plugin's readme.","fix":"- Blocksy Companion: a version later than `2.1.60` (the sources do not name the exact fixed version).","status":"open","published_at":"2026-10-30T15:16:54+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:29+00:00","updated_at":"2026-10-30T15:33:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T15:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Blocksy Companion: a version later than `2.1.60` (the sources do not name the exact fixed version).","reach":"internet","title":"Blocksy Companion WordPress plugin: stored cross-site scripting through versions 2.1.60","impact":"medium","summary":"Blocksy Companion, a WordPress plugin from Creative Themes, has a stored cross-site scripting flaw in versions through 2.1.60. An attacker can plant script that runs in the browser of whoever views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","blocksy-companion","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers, possibly stealing sessions or admin actions.","analyst_note":"Confirm the fixed version and the required privilege level from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-65444.","how_to_check":"- Check the installed Blocksy Companion version in the WordPress admin plugins list or the plugin's readme.\n- unknown for other checks; the sources do not say which settings or roles are required.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Blocksy Companion plugin at or below version 2.1.60 are in scope. The sources do not say which user role is needed to store the script or which settings are required, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":4122,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-65444':15A,18A '2.1.60':12A,46B,94C 'affect':61B,88C 'allow':84C 'attack':48B 'blocksi':1A,20B,27B,79C,82C,89C 'blocksy-companion':19B,81C 'browser':56B 'companion':2A,21B,28B,80C,83C,90C 'creativ':33B,77C 'cross':7A,39B,72C 'cross-sit':6A,38B,71C 'cve':13A,16A 'flaw':42B 'generat':70C 'host':25B 'improp':63C 'input':66C 'issu':87C 'n/a':92C 'neutral':64C 'packag':22B 'page':62B,69C 'plant':50B 'plugin':4A,31B 'run':53B 'script':9A,41B,51B,74C 'self':24B 'self-host':23B 'site':8A,40B,73C 'store':5A,37B,85C 'theme':34B,78C 'version':11A,44B 'view':59B 'vulner':75C 'web':68C 'whoever':58B 'wordpress':3A,26B,30B 'xss.this':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Blocksy Companion plugin at or below version 2.1.60 are in scope. The sources do not say which user role is needed to store the script or which settings are required, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65444","severity":null,"published_at":"2026-10-30T15:16:54+00:00","modified_at":"2026-10-30T15:16:54+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}