The Cozy Blocks WordPress plugin is vulnerable to stored XSS via the cozyHoverEffect.boxShadow.color attribute in the cozyHoverEffect block. The flaw allows authenticated contributors and above to inject scripts that bypass wp_kses_post filtering because the payload does not use angle brackets but instead uses a double-quote breakout to inject event handlers at render time. This vulnerability affects all versions up to and including 2.2.16 and can lead to script execution in the context of users viewing the compromised pages.

An attacker with contributor-level or higher privileges can inject arbitrary JavaScript code into pages using the cozyHoverEffect block attribute. This script executes in the browsers of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access and above to trusted users only. Review and sanitize content created by contributors carefully. Monitor for plugin updates from cozythemes addressing this issue.