What is the CVSS score of CVE-2026-15334?

CVE-2026-15334 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Cozy Blocks CVE-2026-15334

EUVD-2026-48507 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-9qhm-f7xw-pgrc

WordPress XSS Wordpress Plugin Cozy Blocks Page Builder For Gutenberg Editor Fse With 600 Patterns 58 Blocks Templates Cozythemes

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to load the injected page (UI:R); PR:L reflects mandatory contributor authentication; S:C captures cross-browser session impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:54 vuln.today

CVE Published

Jul 24, 2026 - 06:51 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Cozy Blocks - Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.

Technical ContextAI

The affected component is the 'Advanced Categories' Gutenberg block within the Cozy Blocks plugin (CPE: cpe:2.3:a:cozythemes:cozy_blocks_-_page_builder_for_gutenberg_editor_&_fse_with_600+_patterns,_58_blocks_&_templates:*:*:*:*:*:*:*:*), a WordPress Full Site Editing (FSE) page builder. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the root cause being that the 'icon.view' block attribute is accepted as user-supplied input but neither sanitized on input nor escaped on output before being rendered into page HTML via render.php. The Trac source references pinpoint the flaw to lines 413, 414, 425, 426, and 427 of blocks/advanced-categories/render.php, corroborated by the block attribute definition in block.json at line 354. Because WordPress Gutenberg blocks serialize attributes as JSON and render them server-side via PHP, failure to apply esc_attr() or wp_kses() on output allows arbitrary HTML/JavaScript to be embedded in the rendered markup.

RemediationAI

Upstream fix available (plugin Trac changeset 3619461); the released patched version has not been independently confirmed from available data - verify via the WordPress plugin repository dashboard or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2daddb7a-0ea7-4d11-8699-1982e336120f?source=cve and update to the latest available version exceeding 2.2.11 immediately. As a compensating control while awaiting the patch, restrict Contributor-level account creation or access on your WordPress site - disabling open registration removes the primary access path for an unauthenticated external attacker. Additionally, the Wordfence firewall (free or premium) includes a virtual patch that blocks exploitation attempts at the WAF layer without requiring plugin code changes, though this trades rule-based blocking for a permanent code fix and should not be treated as a long-term substitute.