CVE-2026-75019 Overview
CVE-2026-75019 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Cozy Blocks – Page Builder for Gutenberg Editor & FSE plugin for WordPress. All versions up to and including 2.2.16 are affected. The flaw resides in the handling of the cozyHoverEffect block attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Injected scripts execute in the browser of any user visiting the affected page.
Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.
Affected Products
- Cozy Blocks – Page Builder for Gutenberg Editor & FSE plugin for WordPress
- All versions up to and including 2.2.16
- WordPress sites permitting contributor-level user registration or higher
Discovery Timeline
- 2026-08-25 - CVE-2026-75019 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75019
Vulnerability Analysis
The vulnerability is a stored XSS flaw affecting the Cozy Blocks Gutenberg plugin. Attackers with contributor-level access can persist a malicious payload inside the cozyHoverEffect.boxShadow.color block attribute. The payload survives WordPress's wp_kses_post sanitization on save because it contains no angle brackets. Instead, the payload uses a double-quote character to break out of the attribute value context. When the block renders on the front end, the injected content is emitted into an HTML attribute where it becomes an event handler such as onmouseover or onfocus. Any authenticated or unauthenticated visitor who loads the affected page triggers script execution in their session context.
Root Cause
The root cause is insufficient output escaping when the plugin renders the cozyHoverEffect attribute into inline HTML. The vulnerable code paths reside in includes/functions.php at lines 1759, 1788, 1824, and 2074 in version 2.2.16. Server-side sanitization via wp_kses_post only strips disallowed tags, so an attribute-value breakout using a bare double quote is preserved intact and injected verbatim into rendered markup.
Attack Vector
An authenticated user with the WordPress contributor role or higher crafts a Cozy Blocks element and sets the cozyHoverEffect box-shadow color attribute to a value containing a double quote followed by an event handler and JavaScript. After saving the post or page, the payload is stored in the database. When the page is rendered — including via preview links submitted for editorial review — the injected event handler executes in the visitor's browser. Common outcomes include session cookie theft, forced administrative actions via CSRF chaining, and drive-by redirection to attacker-controlled infrastructure.
See the Wordfence Vulnerability Analysis for the technical write-up and the Cozy Addons Changeset for the vendor fix.
Detection Methods for CVE-2026-75019
Indicators of Compromise
- Post or page content containing the string cozyHoverEffect combined with a double-quote character followed by an HTML event handler such as onmouseover=, onerror=, or onfocus=.
- Contributor or author accounts creating posts referencing Cozy Blocks elements shortly after registration or role assignment.
- Unexpected outbound requests from visitor browsers to third-party domains sourced from rendered Cozy Blocks pages.
Detection Strategies
- Scan the wp_posts table for stored block markup containing cozyHoverEffect alongside quote-and-handler patterns using SQL LIKE queries.
- Review WordPress audit logs for post edits by low-privilege users that modify Cozy Blocks attributes.
- Inspect rendered HTML output for injected event-handler attributes in elements produced by the Cozy Addons plugin.
Monitoring Recommendations
- Alert on new contributor or author account registrations followed by immediate post creation or edits.
- Monitor web server responses for unexpected <script> execution or event-handler attributes on pages rendered by Cozy Blocks.
- Correlate front-end JavaScript errors and Content Security Policy (CSP) violation reports with pages containing Cozy Blocks content.
How to Mitigate CVE-2026-75019
Immediate Actions Required
- Update the Cozy Blocks plugin to the version released after 2.2.16 that contains the vendor patch referenced in the plugin changeset.
- Audit all posts and pages using Cozy Blocks and remove any block content containing suspicious cozyHoverEffect attribute values.
- Review contributor, author, and editor accounts for unauthorized additions and rotate credentials for any accounts with suspicious activity.
Patch Information
The vendor addressed the flaw in a subsequent release of Cozy Addons after 2.2.16. The fix is documented in the WordPress Cozy Addons Changeset and applies proper output escaping to the affected attribute rendering paths in includes/functions.php.
Workarounds
- Restrict contributor-level access to trusted users only and disable open user registration until the plugin is updated.
- Deploy a Web Application Firewall (WAF) rule that blocks POST bodies containing cozyHoverEffect combined with HTML event-handler tokens.
- Enforce a strict Content Security Policy that disallows inline event handlers and inline script execution on front-end pages.
- Temporarily deactivate the Cozy Blocks plugin on production sites where an immediate update is not feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
