CVE-2026-109978

16th percentile - higher than 16% of all known CVEs

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in versions up to and including 2.2.27 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.

An attacker with a Contributor account can execute arbitrary JavaScript in the browser of an administrator or other users, potentially leading to session hijacking or unauthorized actions within the site context.

Update the Cozy Blocks plugin to a version later than 2.2.27; if not possible, restrict Contributor privileges and disable the productRating option until the fix is applied.