CVE-2026-15950 in Cozy Blocks Plugin
Summary
by MITRE • 08/01/2026
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
The Cozy Blocks plugin for WordPress represents a popular page builder solution that integrates with the Gutenberg editor and Full Site Editing framework, offering users over 600 patterns, 58 blocks, and various templates to enhance website creation capabilities. This plugin has been identified as vulnerable to a stored cross-site scripting vulnerability that affects all versions up to and including 2.2.11, creating a significant security risk for WordPress installations that utilize this component. The vulnerability specifically resides within the 'layoutCircle.alignment' block attribute, which demonstrates how seemingly minor implementation details can create substantial attack vectors within content management systems.
The technical flaw stems from insufficient input sanitization and output escaping mechanisms within the plugin's codebase, particularly when processing the layoutCircle.alignment parameter. This weakness allows attackers to inject malicious JavaScript code into the block attributes that are then stored within the WordPress database. When legitimate users subsequently access pages containing these compromised blocks, the injected scripts execute in their browsers, creating a persistent cross-site scripting attack vector. The vulnerability operates as a stored XSS because the malicious code is saved server-side rather than being reflected from a request, making it particularly dangerous as it can affect multiple users over time without requiring repeated exploitation attempts.
The operational impact of this vulnerability extends beyond simple script execution, as authenticated attackers with contributor-level access or higher can leverage this weakness to perform various malicious activities. These include stealing user sessions, defacing websites, redirecting visitors to malicious sites, or even establishing persistent backdoors within the WordPress installation. The low privilege requirement makes this vulnerability particularly concerning since contributors typically have significant editing capabilities within WordPress environments, potentially allowing attackers to escalate their compromise through additional attacks. This weakness directly aligns with CWE-79 which categorizes cross-site scripting vulnerabilities as a fundamental web application security issue.
From a mitigation perspective, the primary solution involves updating to a patched version of the Cozy Blocks plugin where input sanitization and output escaping have been properly implemented for all block attributes. Security professionals should also implement additional protective measures such as regular security audits of WordPress plugins, monitoring for unauthorized code modifications, and implementing content security policies to limit the impact of potential XSS attacks. Organizations should consider restricting contributor-level access to reduce the attack surface and ensure that proper input validation is enforced at multiple layers within their applications. The vulnerability demonstrates the importance of adhering to secure coding practices as outlined in the OWASP Top Ten and aligns with ATT&CK technique T1566 which covers social engineering tactics through malicious content injection.
The broader implications for WordPress security highlight how third-party plugins can introduce significant risks even when they appear to be legitimate tools. This vulnerability serves as a reminder that all components within WordPress installations must undergo rigorous security evaluation, particularly those that handle user-generated content or block attributes that can be manipulated through the administration interface. Regular security monitoring and prompt patch management remain essential practices for maintaining WordPress site integrity, especially given the prevalence of such vulnerabilities in popular plugins that are widely distributed across the WordPress ecosystem. The stored XSS vulnerability underscores the critical need for proper validation of all user inputs and the implementation of robust output escaping mechanisms throughout web applications to prevent malicious code execution.