The Blocksy Companion plugin for WordPress is vulnerable to stored cross‑site scripting through its blocksy_newsletter_subscribe shortcode, allowing an attacker with contributor‑level or higher access to inject arbitrary JavaScript into attributes that are rendered on pages. This flaw causes the injected scripts to run in the context of site visitors whenever the injected content is viewed, due to insufficient input sanitization and output escaping of user‑supplied parameters.

The problem affects every instance of the creativethemeshq Blocksy Companion plugin installed on a WordPress site, in all releases up to and including version 2.1.14. Users who have contributed or higher roles on the site and who can embed the plugin’s shortcode may be the source of the injection.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exfiltration or persistence is not described in the CVE entry; the flaw requires authenticated contributor or higher access, and any visitor to the page where the malicious shortcode is embedded will execute the injected script.