Cozy Blocks vulnerabilities
5 known CVE vulnerabilities in Cozy Blocks, translated and rated.
- CVE-2026-15393Medium
The Cozy Blocks plugin for WordPress up to version 2.2.11 is vulnerable to Stored Cross-Site Scripting via the 'postMeta.font.size' block attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the affected page.
- CVE-2026-75019Medium
The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cozyHoverEffect attribute in versions up to and including 2.2.16. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user visits the affected page.
- CVE-2026-15950Medium
The Cozy Blocks plugin for WordPress is vulnerable to stored XSS via the 'layoutCircle.alignment' block attribute. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
- CVE-2026-15334Medium
The Cozy Blocks plugin for WordPress up to version 2.2.11 is vulnerable to Stored XSS via the 'icon.view' block attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user accesses the page.
- CVE-2026-15333Medium
The Cozy Blocks plugin for WordPress up to version 2.2.11 is vulnerable to Stored XSS via the 'cozyCustomFont' block attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user accesses the page.