CVE-2026-109975 Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-109975?
CVE-2026-109975 is a medium-severity vulnerability in cozythemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox, published on 28 Oct 2026.
Official description
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.
Weakness: CWE-79
Which versions are affected by CVE-2026-109975?
How do I fix CVE-2026-109975?
No fix has been published for CVE-2026-109975 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109975 being exploited?
There is no known exploitation of CVE-2026-109975 in the wild and no public exploit code.
Sources
Also known as GHSA-8vhf-25gh-rfh5.