Cozy Blocks EUVD-2026-111743

Exploitation requires an authenticated account with contributor-level privileges or above (per CVSS PR:L) on the target WordPress site. Beyond authentication, two product-specific conditions must hold: the plugin's productRating option must be enabled, and the associated WooCommerce product must have a non-zero rating - the vulnerable code in product-tab/render.php is only reached under both. These are non-default, feature-dependent prerequisites (including a WooCommerce dependency) that substantially limit realistic exploitation. The injected payload executes when any user views the affected page, so victim interaction is passive page access rather than an explicit action by the attacker's target.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that realistically sits well below top-priority status. The attack vector is network-facing but the CVSS vector itself requires PR:L - an attacker must hold a legitimate authenticated account at contributor level or above, which meaningfully raises the bar on multi-author or membership sites and effectively eliminates anonymous mass exploitation. The scope change (S:C) and only Low confidentiality/integrity impact reflect a classic script-injection-into-another-user's-browser outcome rather than server compromise. There is no CISA KEV listing and no exploitation signal in the input, so this is not confirmed actively exploited; no EPSS score was supplied, so exploitation probability cannot be quantified from the data provided. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with a patch-on-normal-cadence posture. Crucially, exploitation is gated on a specific non-default feature state: the productRating option must be enabled and the associated WooCommerce product must carry a non-zero rating, which narrows the realistically exploitable population further. Overall this reads as a genuine but low-urgency, privilege-and-configuration-constrained issue rather than a high-CVSS-but-overstated emergency.

An attacker who has registered or obtained a contributor-level (or higher) account on a WordPress site running a vulnerable Cozy Blocks version crafts a page using the product-rating block and places a malicious script into the productRating.iconColor value, which is stored without adequate sanitization or output escaping. When the productRating option is enabled against a WooCommerce product with a non-zero rating, the stored payload executes in the browser of any user - including higher-privileged administrators - who subsequently views the injected page. No public exploit identified at time of analysis; the trigger requires the specific feature and WooCommerce rating conditions described.