CVE-2026-109975

10th percentile - higher than 10% of all known CVEs

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in versions up to and including 2.2.27 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.

An attacker with Contributor privileges can execute arbitrary JavaScript in users' browsers, risking session theft or content modification on the site.

Update the Cozy Blocks plugin to a version later than 2.2.27 and consider restricting content publishing by Contributor-role users until the fix is applied.