Stored Cross-Site Scripting Vulnerability in Cozy Blocks Plugin for WordPress

CVE-2026-109975

What is CVE-2026-109975?

The Cozy Blocks plugin for WordPress, utilized for building and managing content within the block editor, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping within the plugin's handling of specific block attributes, specifically 'icon.view', 'icon.layout', and 'icon.gap'. Authenticated attackers, with at least contributor-level access, can exploit this vulnerability to inject malicious scripts into pages. Such injections can execute when users view the compromised pages, leading to potential data theft or further attack scenarios. The vulnerability remains due to a failure in neutralizing certain payloads during rendering, despite the implementation of wp_kses_post during save operations.

References