The Cozy Blocks plugin allows contributors and higher‑privilege users to insert arbitrary scripts through the icon view attribute in block definitions. Because the plugin fails to fully escape quotes and other attribute delimiters, an attacker can place a payload that is stored in the block’s JSON metadata and later executed whenever any site visitor loads the affected page. This creates a cross‑site scripting condition that can be leveraged to steal session cookies, deface content, or perform further actions in the context of the browsing user.

WordPress sites running Cozy Blocks version 2.2.27 or any earlier release are affected. The vulnerability exists on all builds of the plugin where the 'icon.view', 'icon.layout', or 'icon.gap' block attributes are defined, regardless of active theme or other plugins. Sites that grant contributor or higher rights to users can be used to supply the malicious block content.

The CVSS score of 6.4 indicates moderate severity, and the EPSS metric is not available, so the likelihood of widespread exploitation is uncertain. The vulnerability is not listed in the KEV catalog, meaning no publicly known active exploits have been reported. Attackers need authenticated contributor or higher access and must embed the script in a block; once stored, the code runs for every visitor to the page that renders the block. As the stored payload is not neutralized by wp_kses_post, the impact can be maintained across future widget edits and updates until patched.