EUVD-2026-51761
GHSA-9x5x-292c-x6r9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required contributor authentication; UI:R corrected from reported UI:N since victim must visit the injected page to trigger stored XSS payload execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Cozy Blocks - Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum contributor-level role, which grants the ability to create and edit posts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS base score of 6.4 (Medium) is consistent with contributor-authenticated stored XSS with scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a contributor account on the target WordPress site, then creates or edits a page containing the Cozy Blocks progress-bar block and sets the 'layoutCircle.alignment' attribute to a crafted value embedding a JavaScript payload. Each subsequent visitor - including administrators - who loads that page triggers execution of the injected script in their browser, enabling session cookie theft, credential harvesting via injected forms, or redirection to attacker-controlled infrastructure. … |
| Remediation | Upstream fix available (changeset 3619461 in the WordPress plugin SVN repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3619461%40cozy-addons&new=3619461%40cozy-addons); a released patched version number is not independently confirmed from the provided data - verify the current version in the WordPress Plugin Directory before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today