The Cozy Blocks plugin is vulnerable to stored Cross‑Site Scripting via its layoutCircle.alignment block attribute. An authenticated contributor or higher can inject arbitrary JavaScript into the attribute, which is then saved and executed when any user views the affected page. This flaw stems from insufficient input sanitization and output escaping (CWE‑79) and can lead to client‑side script execution, potentially allowing attackers to steal session cookies, perform account takeover, deface content, or redirect users to malicious sites.

All installations of the Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin running version 2.2.11 or earlier are impacted. This includes authors, contributors, and other WordPress roles with editing privileges on the site.

The CVSS score of 6.4 indicates moderate overall risk. The EPSS <1% suggests a very low probability of exploitation under current conditions, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker has at least contributor‑level access to the WordPress site and the ability to edit or create blocks. Once a malicious script is stored in the layoutCircle.alignment attribute, it will become part of every page render for all visitors until removed.