CVE-2025-59573 Overview
CVE-2025-59573 is a Basic Cross-Site Scripting (XSS) vulnerability in the CozyThemes Cozy Blocks (cozy-addons) WordPress plugin. The flaw stems from improper neutralization of script-related HTML tags in a web page, categorized under [CWE-80]. The vulnerability affects all versions of Cozy Blocks up to and including 2.1.29. An unauthenticated attacker can inject script content that executes in the context of a victim's browser, enabling content injection and limited confidentiality impact. The issue is reachable over the network without user interaction or privileges.
Critical Impact
Unauthenticated attackers can inject script-related HTML into pages served by vulnerable Cozy Blocks installations, resulting in code injection against site visitors.
Affected Products
- CozyThemes Cozy Blocks (cozy-addons) WordPress plugin
- All versions up to and including 2.1.29
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-09-22 - CVE-2025-59573 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59573
Vulnerability Analysis
The Cozy Blocks plugin fails to neutralize script-related HTML tags supplied in user-controllable input before rendering that input into a web page. This is a Basic XSS pattern [CWE-80], where tags such as <script>, <iframe>, or event-handler attributes pass through insufficient filtering. When a browser parses the rendered output, the attacker-supplied markup executes as active content.
The attack requires no authentication and no user interaction beyond visiting a page that reflects the injected data. Because the plugin ships as a Gutenberg block/addon package, injection points typically involve block attributes, shortcode parameters, or REST endpoints exposed by the plugin. The EPSS score of 0.224% places active exploitation probability in the lower band, but the low complexity keeps the risk material for public-facing WordPress sites.
Root Cause
The root cause is missing or incomplete output encoding on data flowing from a request parameter or stored block attribute into HTML output. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() with an appropriate allowlist before rendering values from version 2.1.29 and earlier.
Attack Vector
An attacker crafts a request containing script-related HTML in a field processed by Cozy Blocks. When the plugin renders the value, the browser interprets the payload as executable markup. Refer to the Patchstack Vulnerability Report for reproduction details.
Detection Methods for CVE-2025-59573
Indicators of Compromise
- Unexpected <script>, <iframe>, or on*= event-handler attributes stored in WordPress wp_posts or plugin option tables
- Outbound requests from visitor browsers to attacker-controlled domains sourced from pages rendered by Cozy Blocks
- Modifications to post content or block attributes from unauthenticated sessions in web server access logs
Detection Strategies
- Inspect HTTP request bodies to WordPress REST endpoints (/wp-json/) and admin-ajax handlers for script tags and JavaScript URI schemes
- Query the WordPress database for block markup containing <script, javascript:, or onerror= substrings within Cozy Blocks-managed content
- Baseline the output of pages using Cozy Blocks and alert on drift that introduces new external script references
Monitoring Recommendations
- Enable web application firewall (WAF) logging for POST/PUT requests targeting Cozy Blocks endpoints and review anomalies
- Forward WordPress audit logs and web server logs to a centralized SIEM for correlation across authentication and content-change events
- Alert on browser Content Security Policy (CSP) violation reports originating from pages that render Cozy Blocks content
How to Mitigate CVE-2025-59573
Immediate Actions Required
- Identify all WordPress sites running the cozy-addons plugin at version 2.1.29 or earlier and prioritize them for update
- Deactivate Cozy Blocks on any site where a patched release cannot be applied immediately
- Review recently created or modified posts and block content for injected script payloads and remove them
Patch Information
At the time of publication, the Patchstack advisory lists Cozy Blocks up to and including 2.1.29 as affected. Update to a release later than 2.1.29 published by CozyThemes that addresses this issue. Verify the fixed version via the Patchstack Vulnerability Report before deployment.
Workarounds
- Apply a WAF rule that blocks requests containing <script, javascript:, and common event-handler attributes to Cozy Blocks endpoints
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Restrict access to WordPress editing endpoints by IP allowlist where operationally feasible until the plugin is updated
# Configuration example: enforce a restrictive CSP header in Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
