Cozy Blocks Website Builder Business Growth Toolkit Popups Lead Forms Inbox
Monthly
Stored cross-site scripting in the Cozy Blocks WordPress plugin (cozy-addons) through version 2.2.27 lets an authenticated attacker with contributor-level privileges or above inject arbitrary web scripts through the icon.view, icon.layout, and icon.gap attributes of the featured-product-tabs block. Because the wp_kses_post filter applied on save does not neutralize a quote-only attribute-breakout payload containing no '<' character, the block comment and its decoded JSON attributes survive intact and execute when any user later views the injected page. The CVSS 3.1 vector scores this 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and the primary limiting factor is the contributor+ account requirement rather than network reachability; the trigger is a passive page view by a victim, and no public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting in the Cozy Blocks - Website Builder & Business Growth Toolkit plugin for WordPress (slug cozy-addons) up to and including version 2.2.27 lets an authenticated user with contributor-level access or above persist arbitrary script through the productRating.iconColor setting, which is rendered into the product tab without sufficient sanitization or output escaping and executes for anyone who later views the affected page. Exploitation is gated by two non-default, feature-dependent prerequisites: the plugin's productRating option must be enabled and the associated WooCommerce product must carry a non-zero rating, so the vulnerable code in blocks/product-tab/render.php is only reached in that configuration and a WooCommerce dependency is implied. No public exploit code was identified at time of analysis, and the references include a plugin Trac changeset (3752142) alongside the 2.2.27 source that the advisory points to; a released patched version is not independently confirmed in the provided data.
Stored cross-site scripting in the Cozy Blocks WordPress plugin (cozy-addons) through version 2.2.27 lets an authenticated attacker with contributor-level privileges or above inject arbitrary web scripts through the icon.view, icon.layout, and icon.gap attributes of the featured-product-tabs block. Because the wp_kses_post filter applied on save does not neutralize a quote-only attribute-breakout payload containing no '<' character, the block comment and its decoded JSON attributes survive intact and execute when any user later views the injected page. The CVSS 3.1 vector scores this 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and the primary limiting factor is the contributor+ account requirement rather than network reachability; the trigger is a passive page view by a victim, and no public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting in the Cozy Blocks - Website Builder & Business Growth Toolkit plugin for WordPress (slug cozy-addons) up to and including version 2.2.27 lets an authenticated user with contributor-level access or above persist arbitrary script through the productRating.iconColor setting, which is rendered into the product tab without sufficient sanitization or output escaping and executes for anyone who later views the affected page. Exploitation is gated by two non-default, feature-dependent prerequisites: the plugin's productRating option must be enabled and the associated WooCommerce product must carry a non-zero rating, so the vulnerable code in blocks/product-tab/render.php is only reached in that configuration and a WooCommerce dependency is implied. No public exploit code was identified at time of analysis, and the references include a plugin Trac changeset (3752142) alongside the 2.2.27 source that the advisory points to; a released patched version is not independently confirmed in the provided data.