Live › vulnerability › CVE-2026-109978
Go to dashboardThe Cozy Blocks WordPress plugin does not sanitize the productRating.iconColor parameter, so script injected there is stored and runs in the browser of anyone who views the affected page. An attacker with contributor-level access or higher can use this to run scripts in visitors' and admins' sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the Cozy Blocks plugin at version 2.2.27 or earlier that use the productRating option on WooCommerce products with a non-zero rating. Sites without the plugin, or with productRating disabled, are not reached by this code path. Sites where only trusted administrators can edit content have less exposure, since the attacker needs contributor-level access.
No product ranges from the sources yet.
wp plugin get cozy-blocks --field=version (unknown if the slug differs)2.2.27 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
This page as .md · .json · in your agent: get_signal("CVE-2026-109978")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.