WP-Safety

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Security & Risk Analysis

wordpress.org/plugins/cozy-addons

Build any WordPress site without Elementor or Divi. 57 Gutenberg blocks, 600+ ready-made patterns & 40+ FSE templates. No page builder needed.

7K active installs v2.2.11 PHP 7.4+ WP 6.7+ Updated Jul 8, 2026
block-patternsfull-site-editinggutenberg-blockspage-builderwoocommerce-blocks
96
A · Safe
CVEs total6
Unpatched0
Last CVESep 22, 2025
Plugin page Download
Safety Verdict

Is Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Safe to Use in 2026?

Generally Safe

Score 96/100

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.

6 known CVEsLast CVE: Sep 22, 2025Updated 1mo ago
Risk Assessment

The Cozy Addons plugin exhibits a mixed security posture. While it demonstrates good practices in its use of prepared statements for SQL queries and robust output escaping, several areas raise concerns. A significant portion of its AJAX handlers and REST API routes lack proper authorization checks, creating a substantial attack surface for unauthorized actions. The plugin also has a history of six medium-severity vulnerabilities, with past common types including code injection and cross-site scripting, indicating a recurring pattern of input sanitization and authorization weaknesses. Although there are currently no unpatched vulnerabilities and no critical taint flows identified in this analysis, the presence of numerous unprotected entry points combined with past vulnerability trends warrants caution. The plugin's strengths lie in its careful handling of SQL and output, but its lack of comprehensive authorization on its entry points is a notable weakness that could be exploited.

Key Concerns

  • 4 AJAX handlers without auth checks
  • 11 REST API routes without permission callbacks
  • 6 medium-severity vulnerabilities in history
  • Bundled Freemius v1.0 library
Vulnerabilities
6 published

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Security Vulnerabilities

CVEs by Year

3 CVEs in 2024
2024
3 CVEs in 2025
2025
Patched Has unpatched

Severity Breakdown

Medium
6

6 total CVEs

CVE-2025-59573medium · 6.5Improper Control of Generation of Code ('Code Injection')

Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution

Sep 22, 2025 Patched in 2.1.30 (5d)
CVE-2025-47485medium · 5.3Missing Authorization

Cozy Blocks <= 2.1.22 - Missing Authorization

May 7, 2025 Patched in 2.1.23 (6d)
CVE-2025-30838medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Mar 27, 2025 Patched in 2.1.7 (7d)
CVE-2024-50502medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 25, 2024 Patched in 2.0.19 (6d)
CVE-2024-50441medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 24, 2024 Patched in 2.0.16 (7d)
CVE-2024-47355medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Sep 30, 2024 Patched in 2.0.12 (11d)
Version History

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Release Timeline

v2.2.11Current
v2.2.10
v2.2.9
v2.2.8
v2.2.7
v2.2.5
v2.2.4
v2.2.3
v2.2.2
v2.2.1
v2.1.31
v2.1.30
v2.1.291 CVE
CVE-2025-59573
v2.1.281 CVE
CVE-2025-59573
v2.1.271 CVE
CVE-2025-59573
v2.1.261 CVE
CVE-2025-59573
v2.1.251 CVE
CVE-2025-59573
v2.1.241 CVE
CVE-2025-59573
v2.1.231 CVE
CVE-2025-59573
v2.1.222 CVEs
CVE-2025-59573 CVE-2025-47485
Code Analysis
Analyzed Mar 16, 2026

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Code Analysis

Dangerous Functions
0
Raw SQL Queries
2
4 prepared
Unescaped Output
122
1181 escaped
Nonce Checks
18
Capability Checks
14
File Operations
0
External Requests
1
Bundled Libraries
1

Bundled Libraries

Freemius1.0

SQL Query Safety

67% prepared6 total queries

Output Escaping

91% escaped1303 total outputs
Data Flows · Security
All sanitized

Data Flow Analysis

5 flows
cozy_addons_get_option_callback (includes\functions.php:116)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
15 unprotected

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Attack Surface

Entry Points46
Unprotected15

AJAX Handlers 31

authwp_ajax_get_cozy_block_optionincludes\functions.php:127
authwp_ajax_update_cozy_block_optionincludes\functions.php:198
authwp_ajax_get_ca_cpt_enable_statusincludes\functions.php:220
authwp_ajax_toggle_ca_cpt_enableincludes\functions.php:255
authwp_ajax_cozy_addons_toggle_ca_utility_function_statusincludes\functions.php:282
authwp_ajax_cozy_upsell_dismissble_noticeincludes\functions.php:294
authwp_ajax_cozy_blocks_dismissble_noticeincludes\functions.php:340
authwp_ajax_cozy_block_portfolio_gallery_loaderincludes\functions.php:403
noprivwp_ajax_cozy_block_portfolio_gallery_loaderincludes\functions.php:404
authwp_ajax_cozy_block_magazine_grid_loaderincludes\functions.php:681
noprivwp_ajax_cozy_block_magazine_grid_loaderincludes\functions.php:682
authwp_ajax_cozy_block_magazine_list_loaderincludes\functions.php:964
noprivwp_ajax_cozy_block_magazine_list_loaderincludes\functions.php:965
authwp_ajax_cozy_block_popular_posts_loaderincludes\functions.php:1088
noprivwp_ajax_cozy_block_popular_posts_loaderincludes\functions.php:1089
authwp_ajax_cozy_block_trending_posts_loaderincludes\functions.php:1211
noprivwp_ajax_cozy_block_trending_posts_loaderincludes\functions.php:1212
authwp_ajax_cozy_block_advanced_gallery_loaderincludes\functions.php:1294
noprivwp_ajax_cozy_block_advanced_gallery_loaderincludes\functions.php:1295
authwp_ajax_cozy_block_wishlist_render_data_sidebarincludes\functions.php:1372
noprivwp_ajax_cozy_block_wishlist_render_data_sidebarincludes\functions.php:1373
authwp_ajax_cozy_block_wishlist_update_user_wishlistincludes\functions.php:1376
noprivwp_ajax_cozy_block_wishlist_update_user_wishlistincludes\functions.php:1377
authwp_ajax_cozy_block_wishlist_add_to_cartincludes\functions.php:1419
noprivwp_ajax_cozy_block_wishlist_add_to_cartincludes\functions.php:1420
authwp_ajax_cozy_block_quick_view_lightbox_renderincludes\functions.php:1440
noprivwp_ajax_cozy_block_quick_view_lightbox_renderincludes\functions.php:1441
authwp_ajax_cozy_addons_download_plugin_rollback_versionincludes\functions.php:1715
noprivwp_ajax_cozy_addons_download_plugin_rollback_versionincludes\functions.php:1716
authwp_ajax_cozy_addons_activate_rollback_versionincludes\functions.php:1757
noprivwp_ajax_cozy_addons_activate_rollback_versionincludes\functions.php:1758

REST API Routes 15

GET/wp-json/cozy-block/v1/postscore\api\class-block.php:50
GET/wp-json/cozy-block/v1/posts/stickycore\api\class-block.php:60
GET/wp-json/cozy-block/v1/tagscore\api\class-block.php:70
GET/wp-json/cozy-block/v1/commentscore\api\class-block.php:80
GET/wp-json/cozy-block/v1/related-postscore\api\class-block.php:90
GET/wp-json/cozy-block/v1/post-views/(?P<post_id>\d+)core\api\class-block.php:100
GET/wp-json/cozy-block/v1/post-comments/(?P<post_id>\d+)core\api\class-block.php:110
GET/wp-json/cozy-block/v1/post-categoriescore\api\class-block.php:120
GET/wp-json/cozy-block/v1/cf7-shortcode-contentcore\api\class-cf7.php:55
GET/wp-json/cozy-block/v1/pattern-contentcore\api\class-patterns.php:54
GET/wp-json/cozy-block/v1/template-contentcore\api\class-patterns.php:66
GET/wp-json/cozy-block/v1/page-contentcore\api\class-patterns.php:78
GET/wp-json/cozy-block/v1/product-categoriescore\api\class-woo.php:57
GET/wp-json/cozy-block/v1/products/(?P<term_id>\d+)core\api\class-woo.php:71
GET/wp-json/cozy-block/v1/productscore\api\class-woo.php:85
WordPress Hooks 77
actionadmin_noticesadmin\admin-notice.php:62
actionadmin_noticesadmin\admin-notice.php:105
actionadmin_post_cozy_addons_rollbackadmin\admin-notice.php:390
actionwp_enqueue_scriptsblocks\accordion\render.php:181
actionwp_enqueue_scriptsblocks\ad\render.php:47
actionwp_enqueue_scriptsblocks\add-to-cart\render.php:165
actionwp_enqueue_scriptsblocks\advanced-categories\render.php:471
actionwp_enqueue_scriptsblocks\advanced-gallery\render.php:767
actionwp_enqueue_scriptsblocks\advanced-tab\render.php:219
actionwp_enqueue_scriptsblocks\back-to-top\render.php:50
actionwp_enqueue_scriptsblocks\breadcrumb\render.php:61
actionwp_enqueue_scriptsblocks\categorized-post-tabs\render.php:979
actionwp_enqueue_scriptsblocks\cf7-styler\render.php:449
actionwp_enqueue_scriptsblocks\container\render.php:44
actionwp_enqueue_scriptsblocks\countdown-timer\render.php:294
actionwp_enqueue_scriptsblocks\counter\render.php:51
actionwp_enqueue_scriptsblocks\current-time\render.php:74
actionwp_enqueue_scriptsblocks\featured-content-box\render.php:168
actionwp_enqueue_scriptsblocks\featured-post\render.php:716
actionwp_enqueue_scriptsblocks\featured-post-tabs\render.php:731
actionwp_enqueue_scriptsblocks\featured-product\render.php:931
actionwp_enqueue_scriptsblocks\featured-product-tabs\render.php:1097
actionwp_enqueue_scriptsblocks\icon-list\render.php:138
actionwp_enqueue_scriptsblocks\icon-picker\render.php:68
actionwp_enqueue_scriptsblocks\img-compare\render.php:148
actionwp_enqueue_scriptsblocks\magazine-grid\render.php:1125
actionwp_enqueue_scriptsblocks\magazine-list\render.php:755
actionwp_enqueue_scriptsblocks\mega-menu\render.php:305
actionwp_enqueue_scriptsblocks\modal\render.php:160
actionwp_enqueue_scriptsblocks\news-ticker\render.php:50
actionwp_enqueue_scriptsblocks\popular-post\render.php:683
actionwp_enqueue_scriptsblocks\portfolio-gallery\render.php:851
actionwp_enqueue_scriptsblocks\portfolio-gallery-meta\render.php:146
actionwp_enqueue_scriptsblocks\post-carousel\render.php:89
actionwp_enqueue_scriptsblocks\post-comments\render.php:137
actionwp_enqueue_scriptsblocks\post-slider\render.php:50
actionwp_enqueue_scriptsblocks\post-views\render.php:135
actionwp_enqueue_scriptsblocks\pricing-table\render.php:512
actionwp_enqueue_scriptsblocks\product-carousel\render.php:236
actionwp_enqueue_scriptsblocks\product-category\render.php:334
actionwp_enqueue_scriptsblocks\product-review\render.php:530
actionwp_enqueue_scriptsblocks\product-slider\render.php:96
actionwp_enqueue_scriptsblocks\product-tab\render.php:867
actionwp_enqueue_scriptsblocks\progress-bar\render.php:148
actionwp_enqueue_scriptsblocks\quick-view\render.php:344
actionwp_enqueue_scriptsblocks\sidebar-panel\render.php:160
actionwp_enqueue_scriptsblocks\slider\render.php:43
actionwp_enqueue_scriptsblocks\social-icon\render.php:60
actionwp_enqueue_scriptsblocks\social-share\render.php:217
actionwp_enqueue_scriptsblocks\teams\render.php:81
actionwp_enqueue_scriptsblocks\testimonial\render.php:81
actionwp_enqueue_scriptsblocks\toggle-content\render.php:230
actionwp_enqueue_scriptsblocks\trending-post\render.php:672
actionwp_enqueue_scriptsblocks\wishlist\render.php:591
actioninitcore\cpt\ca-mega-menu.php:49
actioninitcore\cpt\ca-portfolio-gallery.php:50
actioninitcore\cpt\ca-portfolio-gallery.php:89
actioninitcore\cpt\ca-portfolio-gallery.php:154
actionsave_postcore\cpt\ca-portfolio-gallery.php:260
filtermanage_ca_portfolio_gallery_posts_columnscore\cpt\ca-portfolio-gallery.php:279
actionmanage_ca_portfolio_gallery_posts_custom_columncore\cpt\ca-portfolio-gallery.php:310
filterquery_loop_block_query_varscore\filters\class-query-loop.php:140
actionenqueue_block_assetscore\library\class-patterns.php:27
actionadmin_enqueue_scriptsincludes\class-admin.php:61
actionadmin_menuincludes\class-admin.php:63
actioninitincludes\class-assets.php:74
actionwp_enqueue_scriptsincludes\class-assets.php:75
actionenqueue_block_editor_assetsincludes\class-assets.php:131
actionenqueue_block_assetsincludes\class-assets.php:132
filterblock_categories_allincludes\class-blocks.php:115
actioninitincludes\class-blocks.php:117
actionrest_api_initincludes\class-core.php:103
actioninitincludes\class-i18n.php:46
actionwp_headincludes\functions.php:62
actionreset_trending_post_views_count_eventincludes\functions.php:93
filterrender_blockincludes\functions.php:2249
filterrender_blockincludes\functions.php:2395

Scheduled Events 1

reset_trending_post_views_count_event
Maintenance & Trust

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Maintenance & Trust

Maintenance Signals

WordPress version tested7.0.2
Last updatedJul 8, 2026
PHP min version7.4
Downloads260K

Community Trust

Rating92/100
Number of ratings21
Active installs7K
Alternatives

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Alternatives

Greenshift – animation and page builder blocks

Greenshift – animation and page builder blocks

greenshift-animation-and-page-builder-blocks

A
89

More than 20 special blocks for Gutenberg to build complex pages and animations with highest possible web vitals score.

70K 20 CVEs
Nova Blocks by Pixelgrade

Nova Blocks by Pixelgrade

nova-blocks

A
97

A collection of distinctive Gutenberg blocks, committed to making your site shine like a newborn star.

800 3 CVEs
ComboBlocks — Block Library & Page Builder

ComboBlocks — Block Library & Page Builder

combo-blocks

A
100

Landing Page Builder, Blog Builder, eCommerce Builder, Niche Site Builder, News Site Builder and More.

100 No CVEs
Gutenwave Blocks – Gutenberg Page Builder Blocks for Block Editor & FSE

Gutenwave Blocks – Gutenberg Page Builder Blocks for Block Editor & FSE

gutenwave-blocks

A
100

Build stunning websites with Gutenberg. Free responsive blocks, starter templates & full site editing support in one lightweight plugin.

50 No CVEs
Blocks Monster

Blocks Monster

blocks-monster

A
100

Blocks Monster – Gutenberg Blocks, Elementor Widgets, Landing Page Builder, WooCommerce Enhancer

10 No CVEs
Developer Profile

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates Developer Profile

CozyThemes

40 plugins · 31K total installs

93
trust score
Avg Security Score
90/100
Avg Patch Time
7 days
View full developer profile
Detection Fingerprints

How We Detect Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/cozy-addons/assets/css/blocks.editor.min.css/wp-content/plugins/cozy-addons/assets/js/blocks.editor.min.js/wp-content/plugins/cozy-addons/assets/css/frontend.min.css/wp-content/plugins/cozy-addons/blocks/accordion/frontend.js/wp-content/plugins/cozy-addons/blocks/advanced-heading/frontend.js/wp-content/plugins/cozy-addons/blocks/blockquote/frontend.js/wp-content/plugins/cozy-addons/blocks/button/frontend.js/wp-content/plugins/cozy-addons/blocks/call-to-action/frontend.js+80 more
Script Paths
/wp-content/plugins/cozy-addons/assets/js/cozy-block-editor.min.js/wp-content/plugins/cozy-addons/assets/js/frontend.min.js
Version Parameters
cozy-addons/assets/css/blocks.editor.min.css?ver=cozy-addons/assets/js/blocks.editor.min.js?ver=cozy-addons/assets/css/frontend.min.css?ver=cozy-addons/blocks/accordion/frontend.js?ver=cozy-addons/blocks/advanced-heading/frontend.js?ver=cozy-addons/blocks/blockquote/frontend.js?ver=cozy-addons/blocks/button/frontend.js?ver=cozy-addons/blocks/call-to-action/frontend.js?ver=cozy-addons/blocks/carousel/frontend.js?ver=cozy-addons/blocks/circle-progress/frontend.js?ver=cozy-addons/blocks/contact-form-7/frontend.js?ver=cozy-addons/blocks/countdown/frontend.js?ver=cozy-addons/blocks/divider/frontend.js?ver=cozy-addons/blocks/divider-one/frontend.js?ver=cozy-addons/blocks/dual-heading/frontend.js?ver=cozy-addons/blocks/flip-box/frontend.js?ver=cozy-addons/blocks/google-map/frontend.js?ver=cozy-addons/blocks/gallery/frontend.js?ver=cozy-addons/blocks/image-box/frontend.js?ver=cozy-addons/blocks/instagram/frontend.js?ver=cozy-addons/blocks/list/frontend.js?ver=cozy-addons/blocks/modal-popup/frontend.js?ver=cozy-addons/blocks/navigation-menu/frontend.js?ver=cozy-addons/blocks/number-counter/frontend.js?ver=cozy-addons/blocks/post-grid/frontend.js?ver=cozy-addons/blocks/post-slider/frontend.js?ver=cozy-addons/blocks/price-table/frontend.js?ver=cozy-addons/blocks/progressbar/frontend.js?ver=cozy-addons/blocks/pricing-table/frontend.js?ver=cozy-addons/blocks/section/frontend.js?ver=cozy-addons/blocks/slider/frontend.js?ver=cozy-addons/blocks/social-share/frontend.js?ver=cozy-addons/blocks/tabs/frontend.js?ver=cozy-addons/blocks/testimonial/frontend.js?ver=cozy-addons/blocks/testimonial-slider/frontend.js?ver=cozy-addons/blocks/timeline/frontend.js?ver=cozy-addons/blocks/tooltip/frontend.js?ver=cozy-addons/blocks/video/frontend.js?ver=cozy-addons/blocks/woo-add-to-cart/frontend.js?ver=cozy-addons/blocks/woo-products/frontend.js?ver=cozy-addons/blocks/woo-search/frontend.js?ver=cozy-addons/blocks/woo-categories/frontend.js?ver=cozy-addons/assets/js/frontend.min.js?ver=

HTML / DOM Fingerprints

CSS Classes
cozy-accordion-wrapcozy-accordion-itemcozy-accordion-headercozy-accordion-contentcozy-advanced-heading-wrapcozy-blockquote-wrapcozy-button-wrapcozy-cta-wrap+35 more
HTML Comments
<!-- wp:cozy-addons/accordion --><!-- wp:cozy-addons/advanced-heading --><!-- wp:cozy-addons/blockquote --><!-- wp:cozy-addons/button -->+35 more
Data Attributes
data-block-client-iddata-cozy-accordiondata-cozy-tabsdata-cozy-sliderdata-cozy-carouseldata-cozy-testimonial-slider+1 more
JS Globals
window.cozyBlockAccordionInitcozyAccordion_window.cozyBlockTabsInitcozyTabs_window.cozyBlockSliderInitcozySlider_+8 more
FAQ

Frequently Asked Questions about Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates