Skip to content
OpenAdvisories

Vendor

CozyThemes

24 known vulnerabilities.

Products

Cozy Blocks 8 Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates 3 Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates 3 Rootblox 2 Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox 2 Hello Agency 1 Fota WP 1 ReviveNews 1 HomeLancer 1 SaasLauncher 1 Blockbooster 1
All Critical High Medium Low Exploited only Public exploit

23 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-24533

    WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

    CozyThemes Cozy Blocks
  • Medium 6.4
    CVE-2026-109975

    Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

    The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all ver…

    CozyThemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox Web / CMS
  • Medium 6.4
    CVE-2026-109978

    Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute

    The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 du…

    CozyThemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox Web / CMS
  • Medium 6.5
    CVE-2026-111843

    WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.

    CozyThemes Rootblox
  • Medium 6.9
    CVE-2026-97070

    WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.

    CozyThemes Cozy Blocks
  • Medium 5.3
    CVE-2026-19948

    Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that …

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-75019

    Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insuf…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15950

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15393

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to …

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15334

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insuffici…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 6.4
    CVE-2026-15333

    Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insu…

    CozyThemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Web / CMS
  • Medium 5.4
    CVE-2025-49375

    WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from n/a through <= 1.0.1.

    CozyThemes HomeLancer
  • Medium 5.3
    CVE-2025-59573

    WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This issue affects Cozy Blocks: from n/a through <= 2.1.29.

    CozyThemes Cozy Blocks
  • Medium 5.0
    CVE-2025-58606

    WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.

    CozyThemes SaasLauncher
  • Medium 5.3
    CVE-2025-47485

    WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through <= 2.1.22.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2025-30838

    WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2024-43341

    WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5.

    CozyThemes Hello Agency
  • Medium 6.5
    CVE-2024-43974

    WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.

    CozyThemes ReviveNews
  • Medium 6.5
    CVE-2024-43980

    WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.

    CozyThemes Fota WP
  • Medium 6.5
    CVE-2024-43979

    WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.

    CozyThemes Blockbooster
  • Medium 6.5
    CVE-2024-50441

    WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.15.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2024-50502

    WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.18.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2024-47355

    WordPress Cozy Blocks plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.11.

    CozyThemes Cozy Blocks