Skip to content
Noroxi

Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates

cozy-addons · plugin

Known security vulnerabilities for Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates. Find out in seconds which version runs on your site with WP Lens.

12 known vulnerabilities

3 exploitable without logging in · latest Sep 1, 2026

Listed on wordpress.org · latest 2.2.25 · last updated Sep 28, 2026 · 6K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-30838login required≤ 2.1.6

    WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-47355login required≤ 2.0.11

    WordPress Cozy Blocks plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-75019contributor+≤ 2.2.16

    Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

    Medium 6.4

  • CVE-2026-15950contributor+≤ 2.2.11

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute

    Medium 6.4

  • CVE-2026-15393contributor+≤ 2.2.11

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute

    Medium 6.4

  • CVE-2026-15334contributor+≤ 2.2.11

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

    Medium 6.4

  • CVE-2026-15333contributor+≤ 2.2.11

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute

    Medium 6.4

  • CVE-2024-50441login required≤ 2.0.15

    WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-50502login required≤ 2.0.18

    WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2026-19948unauthenticated≤ 2.2.17

    Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

    Medium 5.3

  • CVE-2025-59573unauthenticated≤ 2.1.29

    WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability

    Medium 5.3

  • CVE-2025-47485unauthenticated≤ 2.1.22

    WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability

    Medium 5.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory