---
id: CVE-2026-109975
title: >-
  Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site
  Scripting via 'icon.view' Block Attribute
summary: >-
  The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg
  Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored
  Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout
  / icon.gap)…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: cozythemes
product: >-
  Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms &
  Inbox
affected:
  - >-
    cozy_blocks_website_builder_business_growth_toolkit_popups_lead_forms_inbox
    <= 2.2.27
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T01:28:50.750954Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T01:41:50.395Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109975'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/f4041795-8131-459f-9156-5ecf5d6086f6?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L929
  - url: >-
      https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L927
  - url: >-
      https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L935
  - url: >-
      https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L943
  - url: >-
      https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/block.json#L777
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3752142%40cozy-addons&new=3752142%40cozy-addons
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.10026
ingestedAt: '2026-10-28T07:06:27.105Z'
---

## Overview

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.

## Affected

- `cozy_blocks_website_builder_business_growth_toolkit_popups_lead_forms_inbox <= 2.2.27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.