Refine your search

3 vulnerabilities found for Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates by cozythemes

CVE-2026-19948 (GCVE-0-2026-19948)
Vulnerability from cvelistv5
Published
2026-09-01 04:27
Modified
2026-09-01 17:55
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
Summary
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.
References
Impacted products
Vendor Product Version
cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Version: 0   ≤ 2.2.17
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T17:55:10.250594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T17:55:18.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 700+ Patterns, 58 Blocks \u0026 Templates",
          "vendor": "cozythemes",
          "versions": [
            {
              "lessThanOrEqual": "2.2.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 700+ Patterns, 58 Blocks \u0026 Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T04:27:53.093Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f18e25ed-477b-43ae-9661-0f2c4fecd322?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1117"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1087"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1205"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/wishlist/render.php#L12"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/featured-product/render.php#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/product-tab/render.php#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/featured-product-tabs/render.php#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3658120%40cozy-addons\u0026new=3658120%40cozy-addons"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-15T19:28:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-31T15:59:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Cozy Blocks \u003c= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via \u0027wishlistData\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19948",
    "datePublished": "2026-09-01T04:27:53.093Z",
    "dateReserved": "2026-08-15T19:13:04.910Z",
    "dateUpdated": "2026-09-01T17:55:18.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75019 (GCVE-0-2026-75019)
Vulnerability from cvelistv5
Published
2026-08-25 02:26
Modified
2026-08-25 18:11
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives wp_kses_post on save because it contains no angle brackets — only a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value — allowing event-handler injection at the render stage.
References
Impacted products
Vendor Product Version
cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Version: 0   ≤ 2.2.16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:10:59.618925Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T18:11:08.599Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 700+ Patterns, 58 Blocks \u0026 Templates",
          "vendor": "cozythemes",
          "versions": [
            {
              "lessThanOrEqual": "2.2.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 700+ Patterns, 58 Blocks \u0026 Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives wp_kses_post on save because it contains no angle brackets \u2014 only a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value \u2014 allowing event-handler injection at the render stage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T02:26:49.343Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f29d27aa-a0d9-4675-b762-6509c5743dff?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1824"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1759"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1788"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L2074"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3656701%40cozy-addons\u0026new=3656701%40cozy-addons"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-17T13:33:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-24T13:27:31.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Cozy Blocks \u003c= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-75019",
    "datePublished": "2026-08-25T02:26:49.343Z",
    "dateReserved": "2026-08-17T13:18:03.634Z",
    "dateUpdated": "2026-08-25T18:11:08.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15950 (GCVE-0-2026-15950)
Vulnerability from cvelistv5
Published
2026-08-01 07:49
Modified
2026-08-03 19:26
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Impacted products
Vendor Product Version
cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Version: 0   ≤ 2.2.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:26:46.215240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:26:55.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 700+ Patterns, 58 Blocks \u0026 Templates",
          "vendor": "cozythemes",
          "versions": [
            {
              "lessThanOrEqual": "2.2.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cozy Blocks \u2013 Page Builder for Gutenberg Editor \u0026 FSE with 600+ Patterns, 58 Blocks \u0026 Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027layoutCircle.alignment\u0027 Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T07:49:52.697Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc751980-987f-49c5-a9fb-16ba219c174a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/progress-bar/render.php#L117"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/progress-bar/render.php#L158"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3619461%40cozy-addons\u0026new=3619461%40cozy-addons"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-16T13:20:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-31T19:29:28.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Cozy Blocks \u003c= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027layoutCircle.alignment\u0027 Block Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15950",
    "datePublished": "2026-08-01T07:49:52.697Z",
    "dateReserved": "2026-07-16T13:05:18.708Z",
    "dateUpdated": "2026-08-03T19:26:55.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}