The CozyBlocks plugin includes a stored cross‑site scripting flaw that fails to neutralize user input when generating web pages. Because the malicious code is saved and later rendered for any visitor, an attacker can inject JavaScript that runs in the browser context of other users. This weakness can lead to credential theft, session hijacking, or defacement of the site, and is classified as CWE‑79.

WordPress sites using the CozyThemes Cozy Blocks plugin in any version up to and including 2.2.27 are affected. The vulnerability originates from the plugin’s handling of content within the Cozy‑Addons module.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the known exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the stored‑XSS nature of the flaw, the likely attack vector is an attacker who gains write access to a post or content area where the plugin renders data—this could be through the plugin’s configuration UI or ordinary content editing. No additional conditions are described, suggesting that the flaw can be exploited as long as the vulnerable plugin is installed and operational.