CVE-2024-5439: medium-severity vulnerability in creativethemeshq Blocksy
Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4epss 0.3%
The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
creativethemeshq · BlocksyRelated CVEs — creativethemeshq Blocksy
In the same product, most dangerous first.
CVE-2026-8365HIGHBlocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API FieldEPSS 1.1%CVE-2024-3747MEDIUMBlocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me blockEPSS 0.4%CVE-2025-47465MEDIUMWordPress Blocksy theme <= 2.0.97 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2024-4158MEDIUMBlocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-32961MEDIUMWordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1767MEDIUMBlocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%