CVE-2026-12430

Deferred Deferred - Pending Action

Stored XSS in Blocksy Companion WordPress Plugin

Publication date: 2026-06-19

Last updated on: 2026-06-22

Assigner: Wordfence

Description

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-22

Generated

2026-07-09

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-08

NVD

CVE-2026-12430

EUVD

EUVD-2026-37989

Affected Vendors & Products

Vendor	Product	Version / Range
blocksy	companion	to 2.1.45 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Compliance Impact

The vulnerability allows authenticated attackers with editor-level permissions to inject arbitrary web scripts via stored cross-site scripting in certain WordPress installations. This could potentially lead to unauthorized access or manipulation of user data.

Such unauthorized access or data manipulation could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.

However, the provided information does not explicitly detail the direct compliance implications or specific regulatory impacts of this vulnerability.

Executive Summary

The Blocksy Companion plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.1.45. This vulnerability arises due to insufficient input sanitization and output escaping in the admin settings.

Authenticated users with editor-level permissions or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts will execute whenever any user accesses the injected page.

This issue specifically affects multi-site WordPress installations and installations where the unfiltered_html capability has been disabled.

Impact Analysis

This vulnerability can allow attackers with editor-level or higher permissions to inject malicious scripts that execute in the context of other users visiting the affected pages.

Such script execution can lead to unauthorized actions, data theft, session hijacking, or other malicious activities depending on the attacker's intent.

Because the vulnerability requires authenticated access with elevated permissions and affects multi-site or restricted HTML installations, the risk is somewhat limited but still significant in those environments.

Mitigation Strategies

To mitigate this vulnerability, you should update the Blocksy Companion plugin for WordPress to a version later than 2.1.45 where the issue is fixed.

Additionally, review user permissions to ensure that only trusted users have editor-level or higher access, especially in multi-site installations or where unfiltered_html is disabled.

Hi! I’m here to help you understand CVE-2026-12430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70