Stored Cross-Site Scripting in Cozy Blocks for WordPress
CVE-2026-109978

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
Vendor
CVE Published:
28 October 2026

What is CVE-2026-109978?

The Cozy Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting due to improper input sanitization and output escaping in the 'productRating.iconColor' parameter. This vulnerability allows authenticated users with contributor-level access and higher to insert arbitrary scripts, which can execute when a user visits a compromised page. The issue is only triggered when the productRating feature is active, and the related WooCommerce product has a rating greater than zero. Site administrators should take immediate action to update to the latest version, as this flaw can have severe implications for user data security and site integrity.

Affected Version(s)

Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox 0 <= 2.2.27

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/cozy-addons/ta...
https://plugins.trac.wordpress.org/browser/cozy-addons/ta...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.