01 Record

CVE-2026-19948

Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

MediumPUBLISHEDCNA: Wordfence

CNA base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View raw JSON

02 Description

Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-01 04:27Z34 MIN AGO

Last updated

2026-09-01 04:27Z34 MIN AGO

Reserved

2026-08-15

Assigning CNA

Wordfence

Record state

PUBLISHED

Severity

Medium (CVSS 5.3)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-862Missing AuthorizationClass

Data version

5.2

Document digest

aefd95272ec6d4e0ed48456366531133458477d794406ca85ed28cb27a8e6326

05 Affected products

VendorProductVersionsPlatforms

cozythemesCozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates0 to 2.2.17—

06 References

www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/f18e25ed-477b-43ae-9661-0f2c4fecd322?source=cve
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1117
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1087
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/includes/functions.php#L1205
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/wishlist/render.php#L12
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/featured-product/render.php#L14
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/product-tab/render.php#L14
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.16/blocks/featured-product-tabs/render.php#L14
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset?reponame=&old=3658120%40cozy-addons&new=3658120%40cozy-addons

CVE-2026-19948

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Description

03 Metadata

04 Affected products

05 References

CVE-2026-19948

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References