{"id":"CVE-2026-24533","kind":"vulnerability","aliases":["CVE-2026-24533"],"related":[],"title":"Cozy Blocks WordPress plugin: stored XSS through 2.2.27","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.","summary":"The Cozy Blocks plugin (cozy-addons) by CozyThemes does not sanitize some input before rendering it on pages, enabling stored cross-site scripting. An attacker who can store content can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cozy-addons","cozy-blocks","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Cozy Blocks (cozy-addons) plugin is installed and its version, for example in the WordPress admin under Plugins.\n- Compare the installed version against `2.2.27`; the sources say versions through `2.2.27` are affected.","fix":null,"status":"open","published_at":"2026-10-29T13:17:10+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:42+00:00","updated_at":"2026-10-29T13:25:42+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T13:25:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cozy Blocks WordPress plugin: stored XSS through 2.2.27","impact":"medium","summary":"The Cozy Blocks plugin (cozy-addons) by CozyThemes does not sanitize some input before rendering it on pages, enabling stored cross-site scripting. An attacker who can store content can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","cozy-blocks","cozy-addons"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers, stealing sessions","analyst_note":"Confirm the fixed version and required privilege level from the NVD entry or the vendor advisory.","how_to_check":"- Check whether the Cozy Blocks (cozy-addons) plugin is installed and its version, for example in the WordPress admin under Plugins.\n- Compare the installed version against `2.2.27`; the sources say versions through `2.2.27` are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Cozy Blocks (cozy-addons) plugin from CozyThemes, a WordPress block add-on. Exposure depends on who can store content that renders on pages; sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4124,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-24533':11A,14A '2.2.27':8A,91C 'addon':17B,29B,80C 'affect':85C 'allow':81C 'attack':49B 'block':2A,20B,25B,77C,87C 'browser':60B 'content':53B 'cozi':1A,16B,19B,24B,28B,76C,79C,86C 'cozy-addon':15B,27B,78C 'cozy-block':18B 'cozythem':31B,75C 'cross':45B,70C 'cross-sit':44B,69C 'cve':9A,12A 'enabl':42B 'generat':68C 'improp':61C 'input':36B,64C 'issu':84C 'n/a':89C 'neutral':62C 'packag':21B 'page':41B,67C 'plugin':4A,26B 'render':38B 'run':55B 'sanit':34B 'script':47B,56B,72C 'site':46B,71C 'store':5A,43B,52B,82C 'visitor':59B 'vulner':73C 'web':66C 'wordpress':3A,22B 'xss':6A 'xss.this':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cozy Blocks (cozy-addons) plugin from CozyThemes, a WordPress block add-on. Exposure depends on who can store content that renders on pages; sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-24533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24533","severity":null,"published_at":"2026-10-29T13:17:10+00:00","modified_at":"2026-10-29T13:17:10+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}