CVE-2026-75019: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates

CVE-2026-75019 is a stored cross-site scripting vulnerability in the Cozy Blocks – Page Builder for Gutenberg Editor & FSE WordPress plugin. The flaw exists in the cozyHoverEffect block attribute due to inadequate input sanitization and output escaping. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript payloads that persist in pages and execute upon page access by other users. The injected payload bypasses the wp_kses_post filter because it does not contain angle brackets but uses a double-quote breakout in the boxShadow.color attribute to inject event handlers at render time. This vulnerability affects all plugin versions from initial release through 2.2.16 inclusive.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages built with the Cozy Blocks plugin. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking, privilege escalation, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only. Monitor plugin updates from cozythemes for a security patch addressing this issue. Avoid using affected versions (<=2.2.16) in production environments where untrusted contributors have access.