CVE-2026-15393

Name of the Vulnerable Software and Affected Versions The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates versions prior to 2.2.12

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the postMeta.font.size block attribute. These scripts execute whenever a user visits the affected page.

Recommendations Update the plugin to version 2.2.12 or later.