CVE-2026-15950: Cozy Blocks WordPress Plugin XSS Flaw

CVE-2026-15950 Overview

CVE-2026-15950 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Cozy Blocks plugin for WordPress. The flaw affects all versions up to and including 2.2.11. Attackers with contributor-level access or higher can inject arbitrary JavaScript through the layoutCircle.alignment block attribute. The injected payload executes in the browser of any user who views the compromised page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's block rendering logic.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.

Affected Products

Cozy Blocks – Page Builder for Gutenberg Editor & FSE plugin for WordPress
All versions up to and including 2.2.11
WordPress sites permitting contributor-level or higher user registration

Discovery Timeline

2026-08-01 - CVE-2026-15950 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15950

Vulnerability Analysis

The Cozy Blocks plugin registers custom Gutenberg blocks that store user-supplied attributes in post content. The layoutCircle.alignment block attribute in the progress-bar block is rendered directly into the page output without proper sanitization or escaping. This allows an authenticated user to embed JavaScript inside the attribute value, which persists in the database and executes each time the page is loaded. Because the payload is stored, exploitation does not require social engineering the victim into clicking a crafted link. The affected rendering paths are documented in the plugin's render.php for the progress-bar block at lines 117 and 158, per the WordPress Cozy Addons source reference.

Root Cause

The root cause is missing input validation on block attribute values combined with the absence of output escaping when those attributes are echoed into the rendered HTML. WordPress provides functions such as esc_attr() and wp_kses_post() for this purpose, but the affected render path does not apply them to the layoutCircle.alignment attribute before emitting it to the response body.

Attack Vector

An attacker requires a contributor-level WordPress account. The contributor creates or edits a post containing a Cozy Blocks progress-bar block and supplies a malicious value for the layoutCircle.alignment attribute. The payload is stored in wp_posts as part of the block markup. When any user, including administrators, previews or visits the resulting page, the script executes in the context of the site's origin. Attackers can steal authentication cookies, perform CSRF-protected actions using the victim's session, or pivot to full site compromise if an administrator loads the page.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-15950

Indicators of Compromise

Post or page content containing Cozy Blocks progress-bar block markup with <script>, onerror=, onload=, or javascript: strings inside layoutCircle attributes
New or recently modified posts authored by contributor-level accounts referencing the cozy-addons block namespace
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading affected pages
Administrator sessions initiating unusual privileged actions such as user creation or plugin installation immediately after viewing a contributor's draft

Detection Strategies

Query the wp_posts table for post_content values that combine cozy-addons block markers with HTML event handler attributes or <script> tags
Review WordPress audit logs for contributor accounts modifying pages that are subsequently viewed by administrators
Deploy a Web Application Firewall (WAF) rule that inspects submitted block attributes for JavaScript payloads before persistence
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages using Cozy Blocks

Monitoring Recommendations

Alert on creation of contributor and author accounts followed by immediate post creation using Cozy Blocks components
Track plugin version inventory across managed WordPress sites and flag any instance running 2.2.11 or earlier
Correlate administrator session cookies appearing from unexpected IP addresses following page previews of contributor content

How to Mitigate CVE-2026-15950

Immediate Actions Required

Update the Cozy Blocks plugin to the version published in the WordPress Cozy Addons changeset 3619461 or later
Audit all contributor and author accounts and remove any that are inactive, unverified, or unnecessary
Review existing posts and pages for malicious block attribute content and purge injected scripts before republishing
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

The vendor addressed the issue in the changeset referenced above. Site operators should upgrade to the latest release of the Cozy Blocks plugin available in the WordPress plugin directory. Verify the installed version through the WordPress admin plugins screen after upgrading.

Workarounds

Restrict contributor-level and author-level accounts to trusted users only until the patch is applied
Disable the Cozy Blocks plugin on affected sites if immediate patching is not possible
Deploy a WAF rule that blocks requests containing script tags or JavaScript event handlers inside Gutenberg block attributes
Enforce a strict Content Security Policy that disallows inline scripts on public-facing pages

bash

# Update the Cozy Blocks plugin using WP-CLI
wp plugin update cozy-addons
wp plugin get cozy-addons --field=version

# Audit posts for suspicious block content
wp db query "SELECT ID, post_author, post_title FROM wp_posts \
  WHERE post_content LIKE '%cozy-addons%' \
  AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"