Cozythemes
Monthly
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.
Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.
Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.4.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.0.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.0.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.0.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.0.15. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.0.18. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.
Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.
Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.4.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.0.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.0.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.0.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.0.15. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.0.18. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.