CozyThemes WordPress Cozy Blocks Plugin Content Injection Vulnerability

A cross-site scripting (XSS) vulnerability allowing code injection has been identified in the Cozy Blocks WordPress plugin, specifically in versions through 2.1.29. This vulnerability arises from improper neutralization of script-related HTML tags, which could enable a malicious actor to inject content into pages and posts on the affected website. Such an injection could be exploited to introduce phishing pages, for example.

Impact

Exploitation of this vulnerability could lead to unauthorized content injection on affected WordPress sites, potentially allowing for the insertion of malicious or phishing-related content.

Remediation

Users of the Cozy Blocks WordPress plugin should update to version 2.1.30 or later to address this vulnerability.