Plugin icon

Cozy Blocks – Website Builder for Block Editor | 59 Gutenberg Blocks, 700+ Patterns, 50+ Templates

cozy-addons

Vulnerabilities:

13

Last Updated:

September 14, 2026

Active Installs:

6000

Published
Title
Fixed in
CVSS
Published
2026-08-31
Title
Cozy Blocks < 2.2.18 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
Fixed in
Fixed in 2.2.18
CVSS
5.3 (medium)
Published
2026-08-24
Title
Cozy Blocks < 2.2.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
Fixed in
Fixed in 2.2.17
CVSS
5.5 (medium)
Published
2026-07-31
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
Fixed in
Fixed in 2.2.12
CVSS
5.5 (medium)
Published
2026-07-28
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
Fixed in
Fixed in 2.2.12
CVSS
5.5 (medium)
Published
2026-07-23
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Fixed in
Fixed in 2.2.12
CVSS
5.5 (medium)
Published
2026-07-23
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
Fixed in
Fixed in 2.2.12
CVSS
5.5 (medium)
Published
2025-09-22
Title
Cozy Blocks < 2.1.30 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 2.1.30
CVSS
6.5 (medium)
Published
2025-05-07
Title
Cozy Blocks < 2.1.23 - Missing Authorization
Fixed in
Fixed in 2.1.23
CVSS
5.3 (medium)
Published
2025-03-27
Title
Cozy Blocks < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.1.7
CVSS
6.4 (medium)
Published
2024-10-25
Title
Cozy Blocks < 2.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.19
CVSS
6.4 (medium)
Published
2024-10-24
Title
Cozy Blocks < 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.16
CVSS
6.4 (medium)
Published
2024-09-30
Title
Cozy Blocks < 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.12
CVSS
6.4 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.2.4
CVSS
6.1 (medium)