CVE-2026-109975: Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wpksespost is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. They can inject a payload through the affected block attributes when creating or editing content.
When does the injected script execute?
The script executes whenever a user accesses a page containing the injected block content. This can affect other users who view the compromised page.
Are default defenses sufficient to prevent exploitation?
No. The plugin applies wp_kses_post when saving content, but this does not neutralize the described quote-only attribute-breakout payload because it contains no '<' character.
Which versions are affected?
All Cozy Blocks versions through 2.2.27, including 2.2.27, are affected.