CVE-2025-30838: Cozy Blocks XSS Vulnerability

CVE-2025-30838 Overview

CVE-2025-30838 is a stored cross-site scripting (XSS) vulnerability in the CozyThemes Cozy Blocks plugin (cozy-addons) for WordPress. The flaw affects all versions up to and including 2.1.6. An authenticated contributor-level user can inject malicious script payloads that persist in the database and execute in the browsers of site visitors and administrators. The vulnerability is tracked under [CWE-79] and stems from improper neutralization of input during web page generation.

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads that execute in administrator sessions, enabling account takeover and further site compromise.

Affected Products

• CozyThemes Cozy Blocks plugin (cozy-addons) versions through 2.1.6
• WordPress sites running the vulnerable plugin
• Any user session interacting with attacker-controlled block content

Discovery Timeline

• 2025-03-27 - CVE-2025-30838 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30838

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Cozy Blocks plugin, a Gutenberg block library for WordPress. Attacker-supplied input is stored server-side and rendered in subsequent page requests without adequate sanitization or output encoding. Because the payload persists in the database, every user who views the affected page executes the injected script in their browser context.

Exploitation requires an authenticated account with at least contributor-level privileges and involves user interaction, such as an administrator viewing a post or page containing the malicious block. The scope-changed vector indicates that the injected script executes beyond the vulnerable component, reaching the browser trust boundary of any viewer.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Block attributes accepted from the editor are written into rendered HTML without escaping context-sensitive characters. Standard WordPress sanitization helpers such as wp_kses_post(), esc_attr(), or esc_html() are either not applied or applied inconsistently to affected fields in the plugin's block render callbacks.

Attack Vector

An authenticated attacker inserts a Cozy Blocks element into a post or page and supplies a JavaScript payload through a vulnerable block attribute. The payload is stored in wp_posts or associated metadata. When any user renders the page, the browser parses the unescaped markup and executes the attacker's script under the site's origin. Consequences include session cookie theft, forced privilege escalation via administrator actions, arbitrary content modification, and pivoting to persistent backdoors through plugin or theme editing.

No verified public exploit code is available. Refer to the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-30838

Indicators of Compromise

• Post or postmeta records containing <script> tags, on* event handlers, or javascript: URIs within Cozy Blocks attributes
• Unexpected outbound requests from browser sessions to attacker-controlled domains after loading pages built with Cozy Blocks
• New administrator accounts, modified plugin/theme files, or altered wp_options values following contributor activity
• Contributor-role users publishing or previewing content containing encoded payloads such as <script>

Detection Strategies

• Audit wp_posts.post_content and postmeta for Cozy Blocks shortcodes or block markers with embedded script constructs
• Review WordPress user activity logs for contributor accounts creating or editing pages that use cozy-addons blocks
• Deploy a web application firewall rule to flag HTML event handlers and script tags in block editor REST API traffic to /wp-json/wp/v2/

Monitoring Recommendations

• Alert on modifications to administrator accounts, roles, and capabilities that follow contributor-level content edits
• Monitor browser CSP violation reports for inline script executions on pages rendered by Cozy Blocks
• Track plugin version inventory across WordPress installations to flag hosts still running cozy-addons 2.1.6 or earlier

How to Mitigate CVE-2025-30838

Immediate Actions Required

• Upgrade the Cozy Blocks plugin to a version later than 2.1.6 as soon as a patched release is available from CozyThemes
• Restrict contributor and author role assignments to trusted users and review recent role changes
• Scan existing posts and pages built with Cozy Blocks for stored script payloads and remove or sanitize affected content
• Force password resets and invalidate active sessions for administrator accounts if compromise is suspected

Patch Information

The advisory identifies all versions through 2.1.6 as vulnerable. Consult the Patchstack XSS Vulnerability Advisory and the CozyThemes plugin changelog for the fixed release version and upgrade instructions.

Workarounds

• Deactivate the cozy-addons plugin until a patched version can be installed and validated
• Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources
• Remove the unfiltered_html capability from contributor and author roles and audit any custom role grants
• Apply virtual patching through a web application firewall to block XSS payloads targeting block editor endpoints

# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate cozy-addons

# Search stored content for suspicious payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror=%';"