Live › vulnerability › CVE-2026-109975
Go to dashboardThe Cozy Blocks WordPress plugin up to and including 2.2.27 does not properly sanitize block attributes such as icon.view, icon.layout and icon.gap. An authenticated contributor can save a quote-based payload that runs script in the browser of any visitor or editor who opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the Cozy Blocks plugin at version 2.2.27 or earlier that allow contributor-level or higher users to create or edit content. Sites where only trusted administrators write content, or that do not have the plugin installed, are not exposed.
No product ranges from the sources yet.
wp plugin get cozyblocks --field=version if the slug is unknown.2.2.27.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.
This page as .md · .json · in your agent: get_signal("CVE-2026-109975")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.