Executive brief
Cozy Blocks is a WordPress plugin used to design websites with custom layouts and blocks. A security flaw allows users with contributor-level access or higher to embed malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'layoutCircle.alignment' attribute within its block components. This vulnerability exists in all versions up to and including 2.2.11. An authenticated attacker with at least contributor-level permissions can exploit this by injecting arbitrary web scripts into a page via the Gutenberg editor. Because the payload is stored in the database and rendered without proper neutralization, the script executes in the context of any user's browser session when they access the affected page. A patch was introduced in version 2.2.12.
Affected products
- cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates <= 2.2.11
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
References
- https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/progress-bar/render.php
- https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/progress-bar/render.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3619461%40cozy-addons&new=3619461%40cozy-addons
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc751980-987f-49c5-a9fb-16ba219c174a?source=cve