We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Blocksy Companion Plugin Vulnerability (CVE-2026-18488)

Nick Paliughi
On this page

Security Alert Summary

The Blocksy Companion plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the dynamic-data block’s tagName attribute. Insufficient input sanitization and output escaping in affected versions allow authenticated users with author-level access or higher to inject JavaScript that will execute when a visitor or user views an injected page.

CVE Details

  • CVE ID: CVE-2026-18488
  • Affected component: Blocksy Companion plugin for WordPress (dynamic-data block / tagName attribute)
  • Affected versions: All versions up to and including 2.1.51
  • Published: September 1, 2026 at 06:16:36 AM UTC
  • Last modified: September 1, 2026 at 04:16:51 PM UTC
  • CVSS v3.1 base score: 6.4 (MEDIUM)
  • CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: Requires authentication. Privileges required: low (author-level or higher). User interaction: none.
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-site Scripting)

Technical Details

The vulnerability is a stored cross-site scripting (XSS) issue originating from insufficient input sanitization and output escaping of the tagName block attribute in the blocksy/dynamic-data block. Authenticated users with author-level access or higher can supply crafted input that gets stored and later rendered in pages without proper encoding, allowing injected scripts to execute in the context of users who view those pages.

The description identifies the affected element as the tagName attribute of the dynamic-data block. The root cause is a lack of sanitization and escaping when handling and outputting that attribute value. As a stored XSS, the injected payload persists in site content and runs whenever a page containing the injected block is accessed by another user or visitor.

How This Could Impact Your Website

Consider a site with multiple editors and contributors: an external contractor or a contributor with author-level access could insert a crafted value into the dynamic-data block on a page. When internal staff, site administrators, or site visitors open that page, the injected script could run in their browsers, potentially exposing session data or account-related information available to that user context.

Practical consequences include exposure of internal user email addresses or other data rendered to the page and an increased risk of targeted phishing or social engineering against staff members whose browsers execute the malicious script. The impact aligns with the CVSS ratings: limited confidentiality or integrity effects rather than full site takeover.

professional review: If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles and privileges, especially for contributor- and author-level accounts.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and logs for unusual behavior or unexpected content changes.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
FS Poster – WordPress Social media Auto Poster & Scheduler Vulnerability (CVE-2026-10195)
Next Post
Live Composer – Free WordPress Website Builder Plugin Vulnerability (CVE-2026-16788)