The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored… (CVE-2026-75019)

CVE-2026-75019 describes a stored cross-site scripting vulnerability in The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates WordPress plugin. The flaw exists in the cozyHoverEffect.boxShadow.color attribute, where input is not properly sanitized or escaped. The injected payload bypasses wp_kses_post filtering because it contains no angle brackets but uses a double-quote breakout to inject event handlers at render time. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes when any user accesses the compromised page.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages, which execute in the context of any user viewing those pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the affected WordPress site. The vulnerability does not require user interaction to trigger once the page is loaded.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Cozy Blocks plugin if possible. Monitor for updates from the vendor addressing this vulnerability.