Executive Summary

The Blocksy Companion plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.1.45. This vulnerability arises due to insufficient input sanitization and output escaping in the admin settings.

Authenticated users with editor-level permissions or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts will execute whenever any user accesses the injected page.

This issue specifically affects multi-site WordPress installations and installations where the unfiltered_html capability has been disabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with editor-level or higher permissions to inject malicious scripts that execute in the context of other users visiting the affected pages.

Such script execution can lead to unauthorized actions, data theft, session hijacking, or other malicious activities depending on the attacker's intent.

Because the vulnerability requires authenticated access with elevated permissions and affects multi-site or restricted HTML installations, the risk is somewhat limited but still significant in those environments.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Blocksy Companion plugin for WordPress to a version later than 2.1.45 where the issue is fixed.

Additionally, review user permissions to ensure that only trusted users have editor-level or higher access, especially in multi-site installations or where unfiltered_html is disabled.

Useful 0 Not Useful 0