Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates

Information

Software Type Plugin
Software Slug cozy-addons (view on wordpress.org)
Software Status Active
Software Author cozythemes
Software Website cozythemes.com
Software Downloads 309,295
Software Active Installs 6,000
Software Record Last Updated October 14, 2026

14 Vulnerabilities

Submit a Vulnerability
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-97070
Oct 3, 2026
Researcher: Ananda Dhakal
Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
5.3
CVE-2026-19948
Aug 31, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
6.4
CVE-2026-75019
Aug 24, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
6.4
CVE-2026-15950
Jul 31, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
6.4
CVE-2026-15393
Jul 28, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
6.4
CVE-2026-15334
Jul 23, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
6.4
CVE-2026-15333
Jul 23, 2026
Researcher: Wordfence PRISM
Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2025-59573
Sep 22, 2025
Researcher: 0xd4rk5id3
Cozy Blocks <= 2.1.22 - Missing Authorization
5.3
CVE-2025-47485
May 7, 2025
Researcher: Marek Mikita
Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30838
Mar 27, 2025
Researcher: Prissy
Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-50502
Oct 25, 2024
Researcher: Michael
Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-50441
Oct 24, 2024
Researcher: João Pedro Soares de Alcântara
Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-47355
Sep 30, 2024
Researcher: Khalid Yusuf
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
Title Status CVE ID CVSS Researchers Date
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 - Unauthenticated Insecure Direct Object Reference Patched CVE-2026-97070 5.3 Ananda Dhakal October 3, 2026
Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter Patched CVE-2026-19948 5.3 Wordfence PRISM August 31, 2026
Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute Patched CVE-2026-75019 6.4 Wordfence PRISM August 24, 2026
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute Patched CVE-2026-15950 6.4 Wordfence PRISM July 31, 2026
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute Patched CVE-2026-15393 6.4 Wordfence PRISM July 28, 2026
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute Patched CVE-2026-15334 6.4 Wordfence PRISM July 23, 2026
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute Patched CVE-2026-15333 6.4 Wordfence PRISM July 23, 2026
Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2025-59573 6.5 0xd4rk5id3 September 22, 2025
Cozy Blocks <= 2.1.22 - Missing Authorization Patched CVE-2025-47485 5.3 Marek Mikita May 7, 2025
Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-30838 6.4 Prissy March 27, 2025
Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-50502 6.4 Michael October 25, 2024
Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-50441 6.4 João Pedro Soares de Alcântara October 24, 2024
Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-47355 6.4 Khalid Yusuf September 30, 2024
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Patched CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation