The Blocksy Companion plugin for WordPress contains a stored cross‑site scripting vulnerability triggered by the blocksy_newsletter_subscribe shortcode. Unsanitized and unescaped user‑supplied attributes allow an authenticated contributor‑level user to embed arbitrary JavaScript that will be executed on any page where the shortcode appears. The injected script runs in the context of site visitors, enabling session hijacking, credential theft, defacement, or other malicious actions consistent with XSS.

All released versions of the Blocksy Companion WordPress plugin up to and including 2.1.10 are affected. The vendor is creativethemeshq, and the product is the Blocksy Companion plugin. Site administrators should therefore inspect their WordPress installations for these versions and consider upgrading to any later release.

The CVSS score of 6.4 indicates a medium severity, while the EPSS score of < 1 % shows that the likelihood of exploitation is low at present. The vulnerability requires authenticated access with contributor‑level privileges; unauthenticated users cannot exploit it. Though the probability is currently low, the potential impact of untrusted script execution means that a determined attacker could conduct a variety of damage scenarios, so acting before a broader exploitation is observed is prudent.