Skip to content
OpenAdvisories

Vendor

CozyThemes

24 known vulnerabilities.

CozyThemes at a glance

Last 12 months
13
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 3 vulnerabilities August 2026: 2 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 6 vulnerabilities, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202661
Sep 202610
Aug 202620
Jul 202630
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202500
Sep 202520
Aug 202500
Jul 202500
Jun 202500
May 202510
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

Cozy Blocks 8 Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates 3 Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates 3 Rootblox 2 Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox 2 Hello Agency 1 Fota WP 1 ReviveNews 1 HomeLancer 1 SaasLauncher 1 Blockbooster 1
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • Medium 6.5
    CVE-2026-24533

    WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

    CozyThemes Cozy Blocks
  • Medium 6.4
    CVE-2026-109975

    Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

    The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all ver…

    CozyThemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox Web / CMS
  • Medium 6.4
    CVE-2026-109978

    Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute

    The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 du…

    CozyThemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox Web / CMS
  • Critical 9.8
    CVE-2026-112832

    WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.

    CozyThemes Rootblox
  • Medium 6.5
    CVE-2026-111843

    WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.

    CozyThemes Rootblox
  • Medium 6.9
    CVE-2026-97070

    WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.

    CozyThemes Cozy Blocks
  • Medium 5.3
    CVE-2026-19948

    Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that …

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-75019

    Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insuf…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15950

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15393

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to …

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15334

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insuffici…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15333

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insu…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 5.4
    CVE-2025-49375

    WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from n/a through <= 1.0.1.

    CozyThemes HomeLancer
  • Medium 5.3
    CVE-2025-59573

    WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This issue affects Cozy Blocks: from n/a through <= 2.1.29.

    CozyThemes Cozy Blocks
  • Medium 5.0
    CVE-2025-58606

    WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.

    CozyThemes SaasLauncher
  • Medium 5.3
    CVE-2025-47485

    WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through <= 2.1.22.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2025-30838

    WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2024-43341

    WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5.

    CozyThemes Hello Agency
  • Medium 6.5
    CVE-2024-43974

    WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.

    CozyThemes ReviveNews
  • Medium 6.5
    CVE-2024-43980

    WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.

    CozyThemes Fota WP
  • Medium 6.5
    CVE-2024-43979

    WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.

    CozyThemes Blockbooster
  • Medium 6.5
    CVE-2024-50441

    WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.15.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2024-50502

    WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.18.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2024-47355

    WordPress Cozy Blocks plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.11.

    CozyThemes Cozy Blocks