Cozy Blocks Page Builder For Gutenberg Editor Fse With 700 Patterns 58 Blocks Templates
Monthly
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.