CVE-2026-109975

The Cozy Blocks WordPress plugin (versions up to and including 2.2.27 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the content parameter for block attributes icon.view, icon.layout, and icon.gap due to insufficient input sanitization and output escaping. While wp_kses...

CVE-2026-109975 Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content block attribute icon.view / icon.layout / icon.gap' parameter in all versions up to, and including, 2.2.27 due t...

CVE-2026-15334: Improper Neutralization of Input During Web Page Generation

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output...