Cozy Blocks Page Builder For Gutenberg Editor Fse With 600 Patterns 58 Blocks Templates
Monthly
Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.
Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.