What is the CVSS score of CVE-2026-15333?

CVE-2026-15333 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Cozy Blocks CVE-2026-15333

EUVD-2026-48505 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-34g3-7wch-4ww8

WordPress XSS Wordpress Plugin Cozy Blocks Page Builder For Gutenberg Editor Fse With 600 Patterns 58 Blocks Templates Cozythemes

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to visit the injected page to trigger execution, warranting UI:R; contributor access confirmed by description sets PR:L; scope change to victims' browsers confirmed by cross-user impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:55 vuln.today

CVE Published

Jul 24, 2026 - 06:51 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Cozy Blocks - Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the cozyCustomFont block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in includes/functions.php, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.

Technical ContextAI

The affected component is the Cozy Blocks - Page Builder for Gutenberg Editor & FSE plugin by CozyThemes (CPE: cpe:2.3:a:cozythemes:cozy_blocks_-_page_builder_for_gutenberg_editor_&_fse_with_600+_patterns,_58_blocks_&_templates:*:*:*:*:*:*:*:*), a Gutenberg/FSE extension providing 600+ layout patterns and 58 custom blocks for WordPress. The root cause is CWE-79: Improper Neutralization of Input During Web Page Generation. The cozyCustomFont block attribute value is accepted from an editor user, persisted to the WordPress post meta or block markup without sanitization, and then rendered to HTML on the front end without adequate output escaping. Wordfence references confirm the flaw at multiple output points in includes/functions.php at lines 2160, 2170, 2183, 2251, 2254, 2258, and 2374, with identical vulnerable code present in both the 2.2.9 and 2.2.11 tagged releases, indicating the flaw spans at least those two versions with no intermediate fix.

RemediationAI

No patched version has been confirmed from available references - source code at both the 2.2.9 and 2.2.11 tags contains the vulnerable output locations, suggesting a fix had not been released at time of disclosure. Administrators should monitor the plugin's WordPress.org changelog and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0cc9cad8-0e2f-4ecf-9ca7-15ca060879c1 for a confirmed patched release. As an immediate compensating control, deactivate the Cozy Blocks plugin until a fixed version is published; this eliminates the attack surface entirely but removes all associated page builder functionality. If deactivation is not feasible, restrict contributor-level account creation and audit existing contributor accounts, since the attack vector requires a valid contributor session. Enabling Wordfence's WAF with up-to-date XSS firewall rules can reduce exploitation probability but does not eliminate the underlying sanitization flaw.