CVE-2026-15334: Cozy Blocks WordPress Plugin XSS Flaw

CVE-2026-15334 Overview

CVE-2026-15334 is a stored cross-site scripting (XSS) vulnerability in the Cozy Blocks plugin for WordPress, a page builder for the Gutenberg Editor and Full Site Editing (FSE) that ships with over 600 patterns and 58 blocks. The flaw affects all versions up to and including 2.2.11 and stems from insufficient input sanitization and output escaping of the icon.view block attribute in the advanced-categories block. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes whenever another user views the affected page. The issue is tracked under CWE-79.

Critical Impact
Contributor-level accounts can plant persistent JavaScript in WordPress pages, enabling session hijacking, privilege escalation against administrators, and drive-by redirects to attacker-controlled infrastructure.

Affected Products

Cozy Blocks – Page Builder for Gutenberg Editor & FSE (plugin slug: cozy-addons)
All versions through 2.2.11
WordPress sites permitting contributor-level or higher registrations

Discovery Timeline

2026-07-24 - CVE-2026-15334 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-15334

Vulnerability Analysis

The vulnerability resides in the advanced-categories block within the Cozy Addons plugin. The block accepts an icon.view attribute defined in block.json at line 354 that is later consumed by render.php when producing the front-end markup. According to the referenced source lines (render.php lines 413-414 and 425-427), the attribute value is emitted into the rendered HTML without sufficient sanitization or output escaping. Because the value survives the WordPress storage pipeline, any script payload is persisted in the post content and re-executed for every visitor that loads the injected page.

Exploitation requires an authenticated account with contributor privileges or higher. Contributor is a common role granted by many WordPress sites that accept community submissions, making this attack surface broadly reachable.

Root Cause

The root cause is missing escaping on a block attribute that is intended to control an icon style but is treated as safe HTML during server-side rendering. The render.php handler concatenates the icon.view value into an HTML context without applying esc_attr(), esc_html(), or a comparable WordPress escaping function, breaking the plugin's trust boundary between block editor input and rendered output.

Attack Vector

An authenticated contributor edits a post or page, inserts an advanced-categories block, and manipulates the icon.view attribute in the block's JSON payload to include a JavaScript payload. After the post is saved and later viewed by an administrator or site visitor, the injected script executes in the victim's browser under the site's origin. Because the CVSS scope is changed, a successful payload can pivot to actions such as forging administrative requests, stealing session cookies, or modifying DOM content served to other users.

No verified public exploit code is available at the time of writing. See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2026-15334

Indicators of Compromise

Post or page content in wp_posts containing wp:cozy-addons/advanced-categories blocks with icon attributes holding <script>, onerror=, javascript:, or HTML event-handler strings
Unexpected outbound requests from site visitors to unfamiliar domains shortly after loading pages that include Cozy Blocks content
New administrator accounts or modified user roles created shortly after a contributor published or updated a page

Detection Strategies

Query the WordPress database for the plugin's block markers and inspect icon.view attribute values: SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%cozy-addons/advanced-categories%' AND post_content REGEXP '(<script|onerror=|javascript:)';
Deploy a web application firewall rule that inspects POST /wp-json/wp/v2/posts and admin-ajax.php payloads for script tokens inside icon attribute JSON
Review wp-content/plugins/cozy-addons/ version metadata against 2.2.11 or lower to identify vulnerable installations

Monitoring Recommendations

Log and alert on post updates authored by contributor-role accounts, especially those inserting cozy-addons blocks
Monitor browser console errors and Content Security Policy (CSP) violation reports for inline script executions on pages using the plugin
Track privilege changes and cookie theft indicators such as sudden session reuse from new IP addresses following page views

How to Mitigate CVE-2026-15334

Immediate Actions Required

Upgrade the Cozy Blocks (cozy-addons) plugin to the version released after 2.2.11 that includes the fix referenced in the Cozy Addons changeset
Audit existing posts and pages for injected script content in advanced-categories blocks and sanitize or remove affected content
Review contributor and author accounts for signs of misuse, rotating credentials where suspicious activity is detected

Patch Information

The vendor addressed the issue in the release following 2.2.11. The fix is visible in the plugin's Subversion repository via the referenced changeset. Site operators should apply the patched version through the WordPress plugin updater or by manually replacing the plugin directory. Review the referenced render.php source lines to confirm the fixed version applies proper escaping.

Workarounds

Restrict the contributor role by removing rights to use the Cozy Blocks advanced-categories block until the plugin is patched
Deactivate the Cozy Blocks plugin on production sites that cannot be updated immediately
Enforce a strict Content Security Policy (CSP) that blocks inline scripts and restricts script sources to trusted origins

bash

# Update Cozy Blocks via WP-CLI once the fixed version is published
wp plugin update cozy-addons
wp plugin get cozy-addons --field=version

# Optional: temporarily deactivate the plugin site-wide
wp plugin deactivate cozy-addons