Cozy Blocks CVE-2026-109975

Exploitation requires an authenticated WordPress account with contributor-level privileges or higher on a site running Cozy Blocks (cozy-addons) version 2.2.27 or earlier. The attacker must use the plugin's featured-product-tabs block and place a quote-only attribute-breakout payload containing no '<' character into the icon.view, icon.layout, or icon.gap block attribute; this specific shape is what evades the wp_kses_post sanitization applied on save, leaving the block comment and its decoded JSON attributes intact to execute at render time. Payload execution is triggered passively when any user subsequently views the injected page. Limiting factors that reduce real-world exposure: the contributor+ authentication requirement means sites that do not grant accounts to untrusted users, or that restrict registration below contributor, are not exposed to arbitrary attackers; impact is realized only when a victim actually loads the affected page.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world priority is bounded more by its authentication prerequisite than by its network reachability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms PR:L, meaning exploitation requires an authenticated account - the description specifies contributor-level access or above - so this is not an unauthenticated internet-facing bug despite AV:N. The scope-change (S:C) and C:L/I:L reflect that injected script executes in the browser context of other users (e.g., editors/administrators viewing the page), which is the escalation path that gives this bug its real teeth. On exploitation signals: KEV status is not indicated (treat as not listed), no EPSS score was provided, and the references are the Wordfence advisory and plugin source-code lines rather than any proof-of-concept, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a credible-but-not-urgent issue. Net assessment: a real priority for any multi-author WordPress site that grants contributor+ accounts to semi-trusted users, but a lower priority for single-author or tightly controlled sites, since the contributor privilege requirement blocks opportunistic mass exploitation. Note the discrepancy between the product name in the description ('Cozy Blocks - Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates') and the CPE/EUVD name ('Cozy Blocks - Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox') - same vendor (cozythemes) and plugin slug (cozy-addons), but verify the exact product identity with the vendor.

An attacker who holds (or registers for) a contributor-level account on a target WordPress site edits content using the Cozy Blocks featured-product-tabs block and supplies a quote-only, '<'-free payload in the icon.view / icon.layout / icon.gap block attribute. Because wp_kses_post passes the payload on save (it contains no '<'), the script survives in the decoded JSON block attributes and executes at render time whenever another user - such as an editor or administrator reviewing or publishing the page - opens it, potentially hijacking that higher-privileged session. No public exploit code was identified in the provided sources.