CVE-2026-109978 in Cozy Blocks Plugin
Summary
by MITRE • 10/28/2026
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the Cozy Blocks plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting, commonly referred to as XSS. This flaw exists in all versions of the plugin up through and including version 2.2.27. The core issue stems from insufficient input sanitization and output escaping mechanisms when handling user-supplied data. Specifically, the vulnerability is triggered by the productRating.iconColor parameter, which allows an attacker to inject arbitrary web scripts into the application's database or content storage. Because this is a stored XSS vulnerability, the malicious script is persistently saved on the target server rather than being executed solely through a crafted link in a single session. This persistence ensures that every time a victim user accesses a page containing the injected payload, the malicious code will execute within their browser context, potentially leading to severe security compromises such as session hijacking, defacement, or redirection to phishing sites.
The operational impact of this vulnerability is contingent upon specific conditions being met within the WordPress environment. The vulnerable code path is only reachable when two primary criteria are satisfied: first, the productRating option must be enabled in the plugin settings, and second, the associated WooCommerce product must possess a non-zero rating. This conditional execution means that while the flaw exists across all versions up to 2.2.27, it remains dormant on sites where these specific features are not active or configured with valid ratings. However, for e-commerce websites utilizing this functionality, the risk is immediate and direct. An attacker who gains contributor-level access or higher privileges can exploit this weakness by manipulating the icon color parameter during product rating configurations. Once injected, the script becomes part of the stored content, affecting all subsequent visitors who view the affected product page, thereby amplifying the blast radius beyond just the initial attacker to include any authenticated or unauthenticated users depending on site configuration and cookie policies.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The lack of proper sanitization allows raw script tags or event handlers to be stored in the database without being converted into safe HTML entities. Furthermore, from an offensive security standpoint such as the MITRE ATT&CK framework, this behavior corresponds to techniques involving Stored XSS for initial access and potentially credential harvesting if combined with other social engineering tactics. The attacker leverages trusted application contexts to bypass browser same-origin policies, effectively tricking users' browsers into executing malicious scripts that appear to originate from a legitimate source. This undermines the integrity of the web application and can lead to unauthorized actions being performed on behalf of the victim user.
To mitigate this vulnerability, immediate action is required for all administrators running affected versions of the Cozy Blocks plugin. The most effective remediation strategy is to upgrade the plugin to version 2.2.28 or later, where the developers have presumably implemented proper input validation and output encoding routines. Until an update can be applied, site administrators should consider disabling the productRating feature if it is not strictly necessary for their business operations, thereby neutralizing the attack vector entirely by preventing access to the vulnerable code path. Additionally, implementing a Web Application Firewall with robust XSS detection rules may help filter out malicious payloads before they are stored in the database. Regular security audits and penetration testing should be conducted to identify similar input handling flaws across other plugins and themes within the WordPress ecosystem, ensuring that all user inputs are rigorously sanitized against injection attacks regardless of their intended use case.