Logo
Retour à la veille

CVE-2026-15393

Publié : 28 juillet 2026
Modifié : 28 juillet 2026
Lien officiel NVD
Score CVSS
6.4
MEDIUM

Description détaillée

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/blocks/categorized-post-tabs/render.php#L1https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/includes/Helpers/class-block-render.php#L512https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/includes/Helpers/class-block-render.php#L513https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/includes/Helpers/class-block-render.php#L531https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/includes/Helpers/class-block-render.php#L532https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/includes/Helpers/class-block-render.php#L550https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.10/includes/Helpers/class-block-render.php#L551https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/blocks/categorized-post-tabs/render.php#L1https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/Helpers/class-block-render.php#L512https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/Helpers/class-block-render.php#L513https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/Helpers/class-block-render.php#L531https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/Helpers/class-block-render.php#L532https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/Helpers/class-block-render.php#L550https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.11/includes/Helpers/class-block-render.php#L551https://plugins.trac.wordpress.org/changeset?reponame=&old=3619461%40cozy-addons&new=3619461%40cozy-addonshttps://www.wordfence.com/threat-intel/vulnerabilities/id/e93de7ae-c3a8-4536-9c07-e64d7746e05f?source=cve

Dernières Vulnérabilités

CVE-2026-8164

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.

VOIR DÉTAILS

CVE-2026-7521

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666

VOIR DÉTAILS

CVE-2026-6879

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.

VOIR DÉTAILS