CVE-2026-15333 Overview
CVE-2026-15333 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Cozy Blocks – Page Builder plugin for WordPress. The flaw affects all versions up to and including 2.2.11. It results from insufficient input sanitization and output escaping on the cozyCustomFont block attribute. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page.
Critical Impact
Contributor-level accounts can persistently inject JavaScript into WordPress pages, enabling session theft, credential harvesting, and administrative action hijacking against site visitors and editors.
Affected Products
- Cozy Blocks – Page Builder for Gutenberg Editor & FSE (cozy-addons) plugin for WordPress
- All versions up to and including 2.2.11
- WordPress sites permitting contributor-level or higher user registration
Discovery Timeline
- 2026-07-24 - CVE-2026-15333 published to the National Vulnerability Database (NVD)
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-15333
Vulnerability Analysis
The vulnerability resides in the Cozy Blocks plugin's handling of the cozyCustomFont block attribute inside includes/functions.php. The plugin accepts attacker-controlled values from block markup and renders them into the page output without sufficient sanitization or output escaping. When a contributor saves a Gutenberg block that embeds a malicious payload in the cozyCustomFont attribute, the payload is stored in the post content. It is then served to any user who requests the page.
Because the injection is stored and reflected in page output, exploitation does not depend on tricking a target with a crafted link. Any visitor, including administrators previewing or approving the post, executes the payload in the origin of the WordPress site. The scope change reflected in the vulnerability's classification indicates the injected script can act beyond the compromised block context, affecting the broader browser session.
Root Cause
The plugin functions that render the cozyCustomFont attribute do not apply WordPress escaping primitives such as esc_attr(), esc_html(), or wp_kses() before writing the value into HTML or inline style contexts. Multiple sink locations exist across the source file, including lines 2160, 2170, 2183, 2251, 2254, 2258, and 2374 in includes/functions.php at tag 2.2.11. Each sink accepts the raw attribute and concatenates it into rendered markup.
Attack Vector
Exploitation requires an authenticated contributor account. The attacker inserts a Cozy Blocks block into a post or page and manipulates the cozyCustomFont attribute value to break out of the surrounding HTML or CSS context. Common payloads terminate an attribute quote and inject an event handler, or close a style block and introduce a <script> tag. When the post is previewed by an editor or published to visitors, the JavaScript executes with the privileges of the browser session viewing the page.
No verified proof-of-concept code has been published. See the Wordfence advisory and the plugin source at line 2160 for the affected sinks.
Detection Methods for CVE-2026-15333
Indicators of Compromise
- Post or page content containing Cozy Blocks markup with cozyCustomFont attribute values that include <script>, javascript:, onerror=, onload=, or other HTML event handlers.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages authored by contributor accounts.
- New or modified posts authored by low-privilege contributor accounts that reference custom font values with embedded quotes or angle brackets.
Detection Strategies
- Query the WordPress wp_posts table for post_content entries containing the string cozyCustomFont combined with script tags, event handlers, or URI schemes such as javascript: and data:.
- Review Content Security Policy (CSP) violation reports for inline script executions originating from pages that embed Cozy Blocks content.
- Correlate contributor-role logins with subsequent post creation or edit events that introduce Cozy Blocks blocks, and flag payload anomalies in the block JSON.
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) with virtual patching rules targeting XSS injection into WordPress block attributes.
- Monitor administrative session behavior for unexpected privilege changes, plugin installations, or user creation shortly after previewing contributor-authored content.
- Audit the WordPress user registration configuration and alert on new contributor-level accounts, especially where open registration is enabled.
How to Mitigate CVE-2026-15333
Immediate Actions Required
- Update the Cozy Blocks – Page Builder plugin to a version released after 2.2.11 that addresses the cozyCustomFont sanitization issue.
- Audit all contributor and author accounts, disabling any that are unused or unverified, and enforce multi-factor authentication for editorial roles.
- Scan existing posts and pages for stored payloads in Cozy Blocks markup and remove or sanitize any suspicious content before restoring visibility.
Patch Information
The vulnerability is present in Cozy Blocks up to and including version 2.2.11. Refer to the Wordfence vulnerability entry and the plugin changeset for the fixed release and code diff. Apply the vendor-supplied update through the WordPress plugin dashboard or via wp-cli.
Workarounds
- Restrict the contributor role from using Cozy Blocks by disabling the plugin on multi-author sites until the patched version is deployed.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted event handlers, reducing the impact of stored payloads.
- Require editorial review of contributor submissions in a sandboxed preview environment that is isolated from administrator browser sessions.
# Update the Cozy Blocks plugin using wp-cli
wp plugin update cozy-addons
# Verify the installed version is greater than 2.2.11
wp plugin get cozy-addons --field=version
# List contributor accounts for review
wp user list --role=contributor --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
