Thème WordPress
Vulnérabilités Blocksy
Cette page rassemble les failles publiées pour Blocksy, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Blocksy
14 fiches
Blocksy <= 2.1.41 – Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to…
*-2.1.41
2.1.42
08/06/2026
Blocksy <= 2.1.30 – Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, and including, 2.1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-2.1.30
2.1.31
02/03/2026
Blocksy <= 2.1.6 – Authenticated (Shop manager+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and…
*-2.1.6
2.1.7
14/08/2025
Blocksy <= 2.0.97 – Missing Authorization
The Blocksy theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_blocksy_notice_button_click AJAX endpoint in versions up to, and including, 2.0.97. This makes it possible for authenticated attackers, with administrator-level access…
*-2.0.97
2.0.98
07/05/2025
Blocksy <= 2.0.77 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2.0.77 due to insufficient input sanitization and output escaping. This makes it possible…
*-2.0.77
2.0.78
04/12/2024
Blocksy <= 2.0.22 – Cross-Site Request Forgery
The Blocksy theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.22. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to…
*-2.0.22
2.0.23
01/07/2024
Blocksy <= 2.0.50 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-2.0.50
2.0.51
04/06/2024
Blocksy <= 2.0.46 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in all versions up to, and including, 2.0.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
*-2.0.46
2.0.47
20/05/2024
Blocksy <= 2.0.42 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 2.0.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
*-2.0.42
2.0.43
03/05/2024
Blocksy <= 2.0.39 – Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes…
*-2.0.39
2.0.40
24/04/2024
Blocksy <= 2.0.33 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-2.0.33
2.0.34
23/04/2024
Blocksy <= 2.0.22 – Cross-Site Request Forgery to Notice Dismissal
The Blocksy theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.22. This is due to missing or incorrect nonce validation on the wp_ajax_blocksy_notice_button_click ajax action. This makes it possible for unauthenticated…
*-2.0.22
2.0.23
10/04/2024
Blocksy <= 2.0.26 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and…
*-2.0.26
2.0.27
08/03/2024
Blocksy <= 2.0.19 – Authenticated (Editor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via headers/footers in all versions up to, and including, 2.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level…
*-2.0.19
2.0.20
05/02/2024
Thèmes également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.