CozyThemes has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (3). Most affected products: Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox (2), rootblox (2), cozy-addons (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox 2
- rootblox 2
- cozy-addons 1
Worst active — by depth score
CVE-2026-112832Critical· 9.8WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability54CVE-2026-97070Medium· 6.9Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.38CVE-2026-111843Medium· 6.5WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability36CVE-2026-109978Medium· 6.4Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute35CVE-2026-109975Medium· 6.4Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute35
CozyThemes vulnerabilities
CVEs affecting CozyThemes, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-109978Medium· 6.4Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, an…
CVE-2026-109975Medium· 6.4Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)…
CVE-2026-112832Critical· 9.8WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
CVE-2026-111843Medium· 6.5WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.
CVE-2026-97070Medium· 6.9Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.