CVE-2026-24533: WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The vulnerability is network-accessible and has low attack complexity.

Q: What impact could successful exploitation have?

Successful stored XSS could affect confidentiality, integrity, and availability at a low level, with scope changed. Because the payload is stored, it may execute later when another user views affected content.

Q: Which Cozy Blocks versions are affected?

Cozy Blocks versions through 2.2.27 are affected. The available data does not identify a fixed version.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Cozy Blocks plugin to a version that resolves this vulnerability.
Fixed in 2.2.28

Event History

Oct 29, 2026

CVE Published

via MITRE·01:02 PM

Data Sourced

via MITRE·01:02 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The vulnerability is network-accessible and has low attack complexity.

What impact could successful exploitation have?

Successful stored XSS could affect confidentiality, integrity, and availability at a low level, with scope changed. Because the payload is stored, it may execute later when another user views affected content.

Which Cozy Blocks versions are affected?