{"id":"CVE-2026-109978","kind":"vulnerability","aliases":["CVE-2026-109978"],"related":[],"title":"Cozy Blocks WordPress plugin: stored XSS via product rating icon color","description":"The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.","summary":"The Cozy Blocks WordPress plugin does not sanitize the productRating.iconColor parameter, so script injected there is stored and runs in the browser of anyone who views the affected page. An attacker with contributor-level access or higher can use this to run scripts in visitors' and admins' sessions.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-woocommerce-ratings","plugin-not-installed","productrating-disabled"],"how_to_check":"- Check the installed Cozy Blocks plugin version in the WordPress admin plugins list or with `wp plugin get cozy-blocks --field=version` (unknown if the slug differs)\n- Confirm whether the productRating option is enabled on pages that show WooCommerce products with a non-zero rating","fix":"- Update the Cozy Blocks plugin to a version newer than `2.2.27` (the sources do not name the fixed version)","status":"open","published_at":"2026-10-28T07:16:45+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","triaged_at":"2026-10-28T07:33:02+00:00","updated_at":"2026-10-28T07:33:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:33:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Cozy Blocks plugin to a version newer than `2.2.27` (the sources do not name the fixed version)","reach":"internet","title":"Cozy Blocks WordPress plugin: stored XSS via product rating icon color","impact":"medium","summary":"The Cozy Blocks WordPress plugin does not sanitize the productRating.iconColor parameter, so script injected there is stored and runs in the browser of anyone who views the affected page. An attacker with contributor-level access or higher can use this to run scripts in visitors' and admins' sessions.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Scripts run in visitors' and admins' browsers on affected pages","analyst_note":"","how_to_check":"- Check the installed Cozy Blocks plugin version in the WordPress admin plugins list or with `wp plugin get cozy-blocks --field=version` (unknown if the slug differs)\n- Confirm whether the productRating option is enabled on pages that show WooCommerce products with a non-zero rating","needs_analyst":false,"not_affected_if":["plugin-not-installed","productrating-disabled","no-woocommerce-ratings"],"who_is_affected":"Sites running the Cozy Blocks plugin at version `2.2.27` or earlier that use the productRating option on WooCommerce products with a non-zero rating. Sites without the plugin, or with productRating disabled, are not reached by this code path. Sites where only trusted administrators can edit content have less exposure, since the attacker needs contributor-level access.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3452,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109978':14A,17A '-2026':13A,16A '2.2.27':108C 'access':59B,128C,144C 'admin':71B 'affect':51B 'anyon':47B 'arbitrari':133C 'associ':163C 'attack':54B,123C 'authent':122C 'block':2A,26B,75C,80C,83C 'browser':45B 'builder':77C 'code':150C 'color':11A 'contributor':57B,126C 'contributor-level':56B,125C 'cozi':1A,25B,74C 'cross':94C 'cross-sit':93C 'cve':12A,15A 'due':109C 'editor':81C 'enabl':160C 'escap':116C 'execut':140C 'gutenberg':82C 'higher':61B 'host':21B 'icon':10A 'includ':107C 'inject':37B,132C,146C 'input':112C 'insuffici':111C 'level':58B,127C 'make':118C 'non':169C 'non-zero':168C 'option':158C 'output':115C 'packag':18B 'page':52B,137C,147C 'paramet':34B,100C 'path':151C 'pattern':84C 'plugin':4A,28B,86C 'possibl':120C 'product':8A,165C 'productr':157C 'productrating.iconcolor':33B,99C 'rate':9A,171C 'reach':154C 'run':42B,66B 'sanit':31B,113C 'script':36B,67B,96C,135C 'self':20B 'self-host':19B 'session':72B 'site':95C 'store':5A,40B,92C 'templat':85C 'use':63B 'user':143C 'version':103C 'via':7A,97C 'view':49B 'visitor':69B 'vulner':90C,149C 'web':134C 'websit':76C 'whenev':141C 'woocommerc':22B,164C 'wordpress':3A,23B,27B,79C,88C 'xss':6A 'zero':170C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cozy Blocks plugin at version `2.2.27` or earlier that use the productRating option on WooCommerce products with a non-zero rating. Sites without the plugin, or with productRating disabled, are not reached by this code path. Sites where only trusted administrators can edit content have less exposure, since the attacker needs contributor-level access.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109978","severity":null,"published_at":"2026-10-28T07:16:45+00:00","modified_at":"2026-10-28T07:16:45+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","fetched_at":"2026-10-28T07:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}