CVE-2026-19948 Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-19948

The Cozy Blocks WordPress plugin (all versions up to and including 2.2.17 ) is vulnerable to authorization bypass . Multiple block renderers unconditionally emit the sidebarNonce value into public page HTML with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass th...

WordPress Cozy Blocks plugin <= 2.2.17 - Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability

Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Cozy Blocks versions = 2.2.17...