---
id: "CVE-2026-109975"
kind: "vulnerability"
aliases: ["CVE-2026-109975"]
title: "Cozy Blocks WordPress plugin: stored XSS via block attributes"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cozy-blocks", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed", "plugin-updated"]
published_at: "2026-10-28T07:16:45+00:00"
first_seen_at: "2026-10-28T07:31:37+00:00"
updated_at: "2026-10-28T07:33:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109975", "first_seen_at": "2026-10-28T07:31:37+00:00"}]
---

# Cozy Blocks WordPress plugin: stored XSS via block attributes

The Cozy Blocks WordPress plugin up to and including 2.2.27 does not properly sanitize block attributes such as icon.view, icon.layout and icon.gap. An authenticated contributor can save a quote-based payload that runs script in the browser of any visitor or editor who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Cozy Blocks plugin in the WordPress admin Plugins screen, or with `wp plugin get cozyblocks --field=version` if the slug is unknown.
- Look for pages or posts containing Cozy Blocks block comments with unusual icon.view, icon.layout or icon.gap attribute values.

## Fix

- Update the Cozy Blocks plugin to a version newer than `2.2.27`.
- Until updated, restrict contributor accounts and review recently edited pages that use Cozy Blocks.

## Timeline

- 2026-10-28T07:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109975

## From the sources

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_