CVE-2026-15393 Overview
CVE-2026-15393 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Cozy Blocks – Page Builder for Gutenberg Editor & FSE WordPress plugin. The flaw affects all versions up to and including 2.2.11. Attackers can inject arbitrary JavaScript through the postMeta.font.size block attribute due to insufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can exploit this issue. Injected scripts execute in the browser of any user who views the affected page.
Critical Impact
Contributor-level attackers can persist arbitrary JavaScript in WordPress pages, enabling session hijacking, credential theft, and administrative account takeover when higher-privileged users view the content.
Affected Products
- Cozy Blocks – Page Builder for Gutenberg Editor & FSE (cozy-addons) WordPress plugin
- All versions up to and including 2.2.11
- WordPress sites permitting contributor-level or higher registration
Discovery Timeline
- 2026-07-28 - CVE-2026-15393 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15393
Vulnerability Analysis
The vulnerability resides in the plugin's block rendering logic, specifically in the class-block-render.php helper class and the categorized-post-tabs/render.php block renderer. The plugin accepts a postMeta.font.size attribute from block configuration and injects the value directly into rendered HTML output. Because the plugin does not sanitize input or escape output, an attacker can supply a font-size value containing JavaScript payloads or HTML event handlers.
Stored XSS in WordPress plugins is particularly dangerous because payloads persist in post content and execute for every visitor. Contributor-level accounts are commonly granted on multi-author sites, lowering the barrier to exploitation. A payload executed in an administrator's browser can create new admin accounts, install malicious plugins, or exfiltrate session tokens.
Root Cause
The root cause is missing input validation and output escaping when handling block attributes. WordPress provides functions such as esc_attr(), esc_html(), and wp_kses() for sanitizing user-supplied values. The affected code paths in class-block-render.php (lines 512-513, 531-532, 550-551) render block attribute values without applying these escaping functions. Attribute values like font size should be constrained to numeric or unit-suffixed strings.
Attack Vector
An authenticated attacker with contributor privileges creates or edits a post containing a Cozy Blocks block. Using the block editor or a crafted REST API request, the attacker sets the postMeta.font.size attribute to a value containing a script payload or HTML with event handlers. When the post is submitted for review or published, the payload is stored in the WordPress database. Any user viewing the page, including administrators reviewing the submission, triggers execution of the injected script in their browser context.
Refer to the Wordfence Vulnerability Report and the WordPress Cozy Addons Helper Class source for the vulnerable code paths.
Detection Methods for CVE-2026-15393
Indicators of Compromise
- Post or page content containing <script> tags, javascript: URIs, or event handlers such as onerror= and onload= within Cozy Blocks block attributes
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing content submitted by contributors
- New WordPress administrator accounts created shortly after contributor-authored content is published or previewed
- Modifications to plugin, theme, or user records without corresponding administrator activity in access logs
Detection Strategies
- Audit the wp_posts table for block markup containing suspicious JavaScript patterns inside cozy-addons block attributes
- Review WordPress access logs for POST requests to /wp-json/wp/v2/posts or /wp-admin/post.php from contributor accounts with unusually large payloads
- Monitor browser telemetry for anomalous script execution originating from WordPress-rendered pages
Monitoring Recommendations
- Enable WordPress security logging and forward audit events to a centralized log platform for correlation
- Alert on creation of new administrator accounts and privilege changes
- Track plugin file integrity and detect unauthorized modifications to core WordPress files
How to Mitigate CVE-2026-15393
Immediate Actions Required
- Update the Cozy Blocks plugin to a version newer than 2.2.11 once available from the vendor
- Review recent posts and pages authored by contributor-level accounts for malicious block attribute content
- Audit WordPress user accounts and remove unnecessary contributor or higher-privileged users
- Rotate credentials and session tokens for administrator accounts that may have viewed contributor-submitted content
Patch Information
The vulnerability is documented against versions through 2.2.11. Refer to the WordPress Cozy Addons Changeset and the Wordfence Vulnerability Report for patch tracking. Apply the vendor-supplied fix as soon as it is published.
Workarounds
- Temporarily deactivate the Cozy Blocks plugin until a patched version is installed
- Restrict contributor and author role assignments to trusted users only
- Deploy a Web Application Firewall (WAF) with rules to block script tags and event handlers in POST parameters targeting WordPress REST endpoints
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
