An authenticated user with contributor or higher access can inject arbitrary JavaScript into WordPress pages through the Cozy Blocks productRating iconColor attribute. The injected payload is stored and rendered whenever a page containing the productRating block is viewed, creating a stored cross‑site scripting flaw that executes in the browsers of all visitors to the affected page.

The Cozy Blocks – Website Builder & Business Growth Toolkit by Cozy Themes, a Gutenberg‑based WordPress plugin, is affected in every release up to version 2.2.27. No other product or version ranges were identified in the available data.

The CVSS score of 6.4 indicates moderate severity, and the vulnerability is only exploitable by an authenticated user with contributor privileges or higher. External IP‑based attacks are not possible, and the EPSS score is not available. While the issue has not been listed in the CISA KEV catalog, an attacker who obtains the required permissions can readily deploy the stored payload and compromise any user who views the affected page.