The Cozy Blocks WordPress plugin suffers from a stored Cross-Site Scripting vulnerability (CWE-79) in the 'icon.view' block attribute due to inadequate sanitization and escaping of user input. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript into pages, which executes in the context of users viewing those pages. This can lead to partial confidentiality and integrity impacts without affecting availability. The vulnerability affects all versions up to and including 2.2.11. No official patch or remediation level has been confirmed as of the publication date.

Successful exploitation allows authenticated users with contributor-level access or above to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to partial disclosure of sensitive information and modification of content or user interactions. There is no direct impact on system availability. The vulnerability is limited to users with some level of authenticated access and does not allow unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider monitoring or reviewing content submitted by contributors for suspicious scripts. Avoid granting unnecessary permissions to users and follow best practices for WordPress plugin updates once a patch is released.