CVE-2026-15334

Name of the Vulnerable Software and Affected Versions Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates versions prior to 2.2.12

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the icon.view block attribute. These scripts execute automatically when a user visits the affected page.

Recommendations Update to a version newer than 2.2.11. Restrict the use of the icon.view attribute to trusted users until the update is applied.