The Cozy Blocks plugin for WordPress stores the value of the block attribute 'postMeta.font.size' without sufficient sanitization or escaping. An authenticated user with contributor or higher privileges can supply malicious content for this attribute, which is later rendered as part of a page. The injected script runs in the browser context whenever any user visits the page, enabling data theft, session hijacking, defacement, or further hosting of malware. The flaw is a classic stored XSS identified as CWE‑79.

Vulnerable versions of Cozy Blocks are all releases up to and including 2.2.11. The plugin is widely deployed in WordPress installations, offering more than 600 design patterns, 58 blocks, and templates. Site administrators and contributors who can create or edit blocks are the likely threat actors; any authenticated visitor to the site can be impacted by the injected code.

The CVSS score for this vulnerability is 6.4, indicating a moderate impact when exploitation is feasible. EPSS is reported as <1%, implying that real‑world exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate to the WordPress site as a contributor or higher, then create or edit a block to inject script payloads. Once the script is stored, any user viewing the page will execute it without additional interaction.