Log in Start free

CozyThemes

Products

ProductCVEsExploitedLatest
Cozy Blocks8–Oct 29, 2026
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates3–Jul 28, 2026
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates3–Sep 1, 2026
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox2–Oct 28, 2026
Rootblox2–Oct 22, 2026
Blockbooster1–Nov 1, 2024
SaasLauncher1–Sep 3, 2025
Fota WP1–Nov 1, 2024
Hello Agency1–Nov 1, 2024
HomeLancer1–Jan 22, 2026
ReviveNews1–Nov 1, 2024

Exploited and recent CVEs

  • CVE-2026-24533 Medium 6.5 WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-109975 Medium 6.4 Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute 0.2%
  • CVE-2026-109978 Medium 6.4 Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute 0.2%
  • CVE-2026-112832 Critical 9.8 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability 0.4%
  • CVE-2026-111843 Medium 6.5 WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-97070 Medium 6.9 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability 0.3%
  • CVE-2026-19948 Medium 5.3 Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter 0.7%
  • CVE-2026-75019 Medium 6.4 Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute 0.3%
  • CVE-2026-15950 Medium 6.4 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute 0.3%
  • CVE-2026-15393 Medium 6.4 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute 0.4%
  • CVE-2026-15334 Medium 6.4 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute 0.4%
  • CVE-2026-15333 Medium 6.4 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute 0.4%
  • CVE-2025-49375 Medium 5.4 WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability 0.3%
  • CVE-2025-59573 Medium 5.3 WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability 0.2%
  • CVE-2025-58606 Medium 5.0 WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability 0.2%
  • CVE-2025-47485 Medium 5.3 WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability 0.4%
  • CVE-2025-30838 Medium 6.5 WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-43341 Medium 6.5 WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability 0.5%
  • CVE-2024-43974 Medium 6.5 WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability 0.5%
  • CVE-2024-43979 Medium 6.5 WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability 0.5%
  • CVE-2024-43980 Medium 6.5 WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability 0.5%
  • CVE-2024-50441 Medium 6.5 WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-50502 Medium 6.5 WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-47355 Medium 6.5 WordPress Cozy Blocks plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability 0.3%