CVE-2026-75019

Name of the Vulnerable Software and Affected Versions Cozy Blocks – Page Builder for Gutenberg Editor & FSE versions prior to 2.2.17

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages by manipulating the cozyHoverEffect block attribute, specifically through a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value. This allows event-handler injection during the render stage, and the payload bypasses wp kses post because it does not use angle brackets.

Recommendations Update the plugin to version 2.2.17 or later. As a temporary mitigation, restrict the ability of users with contributor-level access to edit blocks using the cozyHoverEffect attribute.