WordPress theme
Blocksy security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium12
- Low1
All Blocksy vulnerabilities
- High8.8Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
≤2.1.41Update to 2.1.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_meta Fields
≤2.1.30Update to 2.1.31
- Medium5.5Authenticated (Shop manager+) Stored Cross-Site Scripting
≤2.1.6Update to 2.1.7
- Low2.7Missing Authorization
≤2.0.97Update to 2.0.98
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.77Update to 2.0.78
- Medium4.3Cross-Site Request Forgery
≤2.0.22Update to 2.0.23
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.50Update to 2.0.51
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.46Update to 2.0.47
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.42Update to 2.0.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block
≤2.0.39Update to 2.0.40
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.33Update to 2.0.34
- Medium4.3Cross-Site Request Forgery to Notice Dismissal
≤2.0.22Update to 2.0.23
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.26Update to 2.0.27
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤2.0.19Update to 2.0.20
Blocksy: common questions
Does Blocksy have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in Blocksy: 1 high, 12 medium, 1 low. None are known to affect version null.
How do I check which version of Blocksy I run?
In wp-admin open Appearance → Themes and select the theme; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Blocksy vulnerability?
CVE-2026-8365, published Jun 8, 2026: Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field. Severity: High (CVSS 8.8).
Is any Blocksy vulnerability listed in CISA KEV?
No. None of the known Blocksy vulnerabilities is currently listed in the CISA KEV catalog.