Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-58480
9.8
CRITICALCVSS v3
Severity scale
010
Description
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
Blocksy CompanionWordPress Plugin Directory<p>Blocksy Companion is the official plugin that extends the power of the <a href="https://wordpress.org/themes/blocksy/" rel="ugc">Blocksy WordPress theme</a>. It unlocks extra features, premium integrations, and beautifully designed starter sites that help you build fast, modern, and fully customizable websites with ease.</p>
<p>With Blocksy Companion, you get access to a growing library of starter sites, advanced WooCommerce enhancements, and exclusive extensions that take your website to the next level. Whether you’re creating a personal blog, a business website, or a professional online store, this plugin provides the tools you need to design stunning layouts and improve your workflow.</p>
<p>Built for performance and flexibility, Blocksy Companion integrates seamlessly with popular WordPress plugins like WooCommerce, Elementor, Brizy, Beaver Builder, WPML and ACF. It gives you powerful customization options, dynamic features, and optimized code — all without slowing down your site.</p>
<h4>Key features:</h4>
<ul>
<li><strong>Starter Sites Library</strong> – import professionally designed demo sites with one click and kickstart your project.</li>
<li><strong>Extra Extensions</strong> – unlock advanced features such as Cookies Consent, Custom Code Snippets, Trending Posts, and more.</li>
<li><strong>WooCommerce Enhancements</strong> – boost your online store with additional customization options and modern layouts.</li>
<li><strong>Page Builder Ready</strong> – works perfectly with Elementor, Brizy, Beaver Builder, and other popular WordPress page builders.</li>
<li><strong>Advanced Integrations</strong> – seamless compatibility with Mailchimp, Rank Math, WPML, and other top WordPress plugins.</li>
<li><strong>Performance Focused</strong> – lightweight, fast, and optimized for speed to ensure a smooth user experience.</li>
<li><strong>Developer Friendly</strong> – clean, extendable codebase that makes customization and scaling easy.</li>
</ul>
<h4>Minimum Requirements</h4>
<ul>
<li>WordPress 5.0 or greater</li>
<li>PHP version 7.0 or greater</li>
</ul>
WordPress Plugin Directory<p>Blocksy Companion is the official plugin that extends the power of the <a href="https://wordpress.org/themes/blocksy/" rel="ugc">Blocksy WordPress theme</a>. It unlocks extra features, premium integrations, and beautifully designed starter sites that help you build fast, modern, and fully customizable websites with ease.</p>
<p>With Blocksy Companion, you get access to a growing library of starter sites, advanced WooCommerce enhancements, and exclusive extensions that take your website to the next level. Whether you’re creating a personal blog, a business website, or a professional online store, this plugin provides the tools you need to design stunning layouts and improve your workflow.</p>
<p>Built for performance and flexibility, Blocksy Companion integrates seamlessly with popular WordPress plugins like WooCommerce, Elementor, Brizy, Beaver Builder, WPML and ACF. It gives you powerful customization options, dynamic features, and optimized code — all without slowing down your site.</p>
<h4>Key features:</h4>
<ul>
<li><strong>Starter Sites Library</strong> – import professionally designed demo sites with one click and kickstart your project.</li>
<li><strong>Extra Extensions</strong> – unlock advanced features such as Cookies Consent, Custom Code Snippets, Trending Posts, and more.</li>
<li><strong>WooCommerce Enhancements</strong> – boost your online store with additional customization options and modern layouts.</li>
<li><strong>Page Builder Ready</strong> – works perfectly with Elementor, Brizy, Beaver Builder, and other popular WordPress page builders.</li>
<li><strong>Advanced Integrations</strong> – seamless compatibility with Mailchimp, Rank Math, WPML, and other top WordPress plugins.</li>
<li><strong>Performance Focused</strong> – lightweight, fast, and optimized for speed to ensure a smooth user experience.</li>
<li><strong>Developer Friendly</strong> – clean, extendable codebase that makes customization and scaling easy.</li>
</ul>
<h4>Minimum Requirements</h4>
<ul>
<li>WordPress 5.0 or greater</li>
<li>PHP version 7.0 or greater</li>
</ul>
NVD