Live › vulnerability › CVE-2026-24533
The Cozy Blocks plugin (cozy-addons) by CozyThemes does not sanitize some input before rendering it on pages, enabling stored cross-site scripting. An attacker who can store content can run scripts in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Sites running the Cozy Blocks (cozy-addons) plugin from CozyThemes, a WordPress block add-on. Exposure depends on who can store content that renders on pages; sites without this plugin can skip it.
No product ranges from the sources yet.
2.2.27; the sources say versions through 2.2.27 are affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.
This page as .md · .json · in your agent: get_signal("CVE-2026-24533")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.