CO
Vendor
cozythemes
17
CVEs
0
On KEV
5
New 30D
Products
RO9.8
Rootblox
CozyThemes
2 CVEs0 on KEV2 new
CB6.4
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
cozythemes
2 CVEs0 on KEV2 new
CB6.9
Cozy Blocks
CozyThemes
3 CVEs0 on KEV1 new
CB6.4
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
cozythemes
3 CVEs0 on KEV0 new
CB6.4
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
cozythemes
3 CVEs0 on KEV0 new
BL9.8
Blockbooster
Cozythemes
1 CVEs0 on KEV0 new
FO9.8
Fotawp
Cozythemes
1 CVEs0 on KEV0 new
HA9.8
Hello Agency
Cozythemes
1 CVEs0 on KEV0 new
RE9.8
Revivenews
Cozythemes
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109975 New | CB Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox cozythemes | 6.4 | Oct 28 | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute |
| CVE-2026-109978 New | CB Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox cozythemes | 6.4 | Oct 28 | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute |
| CVE-2026-112832 New | RO Rootblox CozyThemes | 9.8 | Oct 22 | WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability |
| CVE-2026-111843 | RO Rootblox CozyThemes | 6.5 | Oct 20 | WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97070 | CB Cozy Blocks CozyThemes | 6.9 | Oct 5 | WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-19948 | CB Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates cozythemes | 5.3 | Sep 1 | Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter |
| CVE-2026-75019 | CB Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates cozythemes | 6.4 | Aug 25 | Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute |
| CVE-2026-15950 | CB Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates cozythemes | 6.4 | Aug 1 | Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute |
| CVE-2026-15393 | CB Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates cozythemes | 6.4 | Jul 28 | Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute |
| CVE-2026-15334 | CB Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates cozythemes | 6.4 | Jul 24 | Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute |
| CVE-2026-15333 | CB Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates cozythemes | 6.4 | Jul 24 | Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute |
| CVE-2024-43980 | FO Fotawp Cozythemes | 9.8 | Nov 1 | Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through… |
| CVE-2024-43979 | BL Blockbooster Cozythemes | 9.8 | Nov 1 | Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through… |
| CVE-2024-43974 | RE Revivenews Cozythemes | 9.8 | Nov 1 | Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2 |
| CVE-2024-43341 | HA Hello Agency Cozythemes | 9.8 | Nov 1 | Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through… |
| CVE-2024-50441 | CB Cozy Blocks Cozythemes | 5.4 | Oct 28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy… |
| CVE-2024-50502 | CB Cozy Blocks Cozythemes | 5.4 | Oct 28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects… |