{"id":"CVE-2026-109975","title":"Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute","summary":"The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"cozythemes","product":"Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","affected":["cozy_blocks_website_builder_business_growth_toolkit_popups_lead_forms_inbox <= 2.2.27"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T01:28:50.750954Z"},"published":"2026-10-28","updated":"2026-10-29","sourceUpdated":"2026-10-29T01:41:50.395Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109975","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4041795-8131-459f-9156-5ecf5d6086f6?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L929"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L927"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L935"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L943"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/block.json#L777"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3752142%40cozy-addons&new=3752142%40cozy-addons"}],"tags":["cve.org"],"epss":0.00201,"epssPercentile":0.10026,"ingestedAt":"2026-10-28T07:06:27.105Z","slug":"CVE-2026-109975","body":"## Overview\n\nThe Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.\n\n## Affected\n\n- `cozy_blocks_website_builder_business_growth_toolkit_popups_lead_forms_inbox <= 2.2.27`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}