CVE-2026-75019 in Cozy Blocks Plugin
Summary
by MITRE • 08/25/2026
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives wp_kses_post on save because it contains no angle brackets — only a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value — allowing event-handler injection at the render stage.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in the Cozy Blocks plugin for WordPress, specifically affecting versions up to and including 2.2.16, represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw is rooted in insufficient input sanitization and output escaping mechanisms within the cozyHoverEffect block attribute. The vulnerability allows authenticated attackers who possess contributor-level access or higher privileges to inject arbitrary web scripts into pages managed by the WordPress editor. These injected scripts are not merely transient; they persist on the server side, meaning that any user accessing a page containing the malicious payload will have their browser execute the script automatically upon rendering. This persistence transforms what might otherwise be a session-based attack into a long-term threat vector capable of compromising multiple users over an extended period without further interaction from the attacker.
The technical mechanism behind this exploitation is particularly notable for its ability to bypass standard WordPress security filters, specifically wp_kses_post. Typically, wp_kses_post serves as a robust defense against XSS by stripping out dangerous HTML tags and attributes that could facilitate script execution. However, in this specific instance, the attackers exploit a unique characteristic of the payload: it contains no angle brackets, which are commonly used to denote HTML elements and thus trigger filtering mechanisms. Instead, the attack relies on breaking out of the cozyHoverEffect.boxShadow.color attribute value using double quotes. This technique allows for event-handler injection at the render stage, effectively bypassing the expected sanitization logic because the malicious code is embedded within a CSS property context rather than as standalone HTML tags.
From an operational impact perspective, this vulnerability enables attackers to perform actions that compromise user sessions and data integrity. Once executed in the victim's browser, the injected scripts can steal session cookies, redirect users to phishing sites, or deface web pages. Given that WordPress is widely used for content management across various industries, including e-commerce and corporate intranets, the potential impact extends beyond individual site compromises to broader organizational security incidents. The requirement for authenticated access with at least contributor-level privileges limits the attack surface slightly compared to unauthenticated vulnerabilities, but it remains a serious concern given that many WordPress sites have multiple users with such permissions who may not be fully aware of their ability to inject malicious content through block attributes.
To mitigate this vulnerability, immediate action is required by site administrators and developers. The primary recommendation is to update the Cozy Blocks plugin to version 2.2.17 or later, where these input sanitization and output escaping issues have been addressed. In cases where updating is not immediately feasible, temporary mitigations should include restricting contributor-level access to trusted individuals only and implementing strict content approval workflows before publication. Additionally, deploying a Web Application Firewall with rules tailored to detect unusual patterns in block attribute values can provide an additional layer of defense against similar exploitation attempts.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, the attack vector corresponds to MITRE ATT&CK technique T1059, specifically subtechnique 007 for Command and Scripting Interpreter: JavaScript, illustrating how attackers leverage client-side scripting languages to execute malicious actions within a victim's browser environment. Understanding these classifications helps in mapping the vulnerability to broader security frameworks and ensuring that remediation efforts address both the immediate technical flaw and the underlying process weaknesses that allowed such an injection to occur.