WP-Safety

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Security & Risk Analysis

wordpress.org/plugins/cozy-addons

Build stunning WordPress sites with 50+ advanced blocks, 500+ patterns, and 40+ templates—a fast, effortless website builder.

7K active installs v2.2.7 PHP 7.3+ WP 5.8+ Updated Jan 7, 2026
blockblocksgutenberggutenberg-blockswoocommerce-blocks
96
A · Safe
CVEs total6
Unpatched0
Last CVESep 22, 2025
Plugin page Download
Safety Verdict

Is Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Safe to Use in 2026?

Generally Safe

Score 96/100

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) has a strong security track record. Known vulnerabilities have been patched promptly.

6 known CVEsLast CVE: Sep 22, 2025Updated 2mo ago
Risk Assessment

The Cozy Addons plugin exhibits a mixed security posture. While it demonstrates good practices in its use of prepared statements for SQL queries and robust output escaping, several areas raise concerns. A significant portion of its AJAX handlers and REST API routes lack proper authorization checks, creating a substantial attack surface for unauthorized actions. The plugin also has a history of six medium-severity vulnerabilities, with past common types including code injection and cross-site scripting, indicating a recurring pattern of input sanitization and authorization weaknesses. Although there are currently no unpatched vulnerabilities and no critical taint flows identified in this analysis, the presence of numerous unprotected entry points combined with past vulnerability trends warrants caution. The plugin's strengths lie in its careful handling of SQL and output, but its lack of comprehensive authorization on its entry points is a notable weakness that could be exploited.

Key Concerns

  • 4 AJAX handlers without auth checks
  • 11 REST API routes without permission callbacks
  • 6 medium-severity vulnerabilities in history
  • Bundled Freemius v1.0 library
Vulnerabilities
6

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Security Vulnerabilities

CVEs by Year

3 CVEs in 2024
2024
3 CVEs in 2025
2025
Patched Has unpatched

Severity Breakdown

Medium
6

6 total CVEs

CVE-2025-59573medium · 6.5Improper Control of Generation of Code ('Code Injection')

Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution

Sep 22, 2025 Patched in 2.1.30 (5d)
CVE-2025-47485medium · 5.3Missing Authorization

Cozy Blocks <= 2.1.22 - Missing Authorization

May 7, 2025 Patched in 2.1.23 (6d)
CVE-2025-30838medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Mar 27, 2025 Patched in 2.1.7 (7d)
CVE-2024-50502medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 25, 2024 Patched in 2.0.19 (6d)
CVE-2024-50441medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 24, 2024 Patched in 2.0.16 (7d)
CVE-2024-47355medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Sep 30, 2024 Patched in 2.0.12 (11d)
Code Analysis
Analyzed Mar 16, 2026

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Code Analysis

Dangerous Functions
0
Raw SQL Queries
2
4 prepared
Unescaped Output
122
1181 escaped
Nonce Checks
18
Capability Checks
14
File Operations
0
External Requests
1
Bundled Libraries
1

Bundled Libraries

Freemius1.0

SQL Query Safety

67% prepared6 total queries

Output Escaping

91% escaped1303 total outputs
Data Flows
All sanitized

Data Flow Analysis

5 flows
cozy_addons_get_option_callback (includes\functions.php:116)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
15 unprotected

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Attack Surface

Entry Points46
Unprotected15

AJAX Handlers 31

authwp_ajax_get_cozy_block_optionincludes\functions.php:127
authwp_ajax_update_cozy_block_optionincludes\functions.php:198
authwp_ajax_get_ca_cpt_enable_statusincludes\functions.php:220
authwp_ajax_toggle_ca_cpt_enableincludes\functions.php:255
authwp_ajax_cozy_addons_toggle_ca_utility_function_statusincludes\functions.php:282
authwp_ajax_cozy_upsell_dismissble_noticeincludes\functions.php:294
authwp_ajax_cozy_blocks_dismissble_noticeincludes\functions.php:340
authwp_ajax_cozy_block_portfolio_gallery_loaderincludes\functions.php:403
noprivwp_ajax_cozy_block_portfolio_gallery_loaderincludes\functions.php:404
authwp_ajax_cozy_block_magazine_grid_loaderincludes\functions.php:681
noprivwp_ajax_cozy_block_magazine_grid_loaderincludes\functions.php:682
authwp_ajax_cozy_block_magazine_list_loaderincludes\functions.php:964
noprivwp_ajax_cozy_block_magazine_list_loaderincludes\functions.php:965
authwp_ajax_cozy_block_popular_posts_loaderincludes\functions.php:1088
noprivwp_ajax_cozy_block_popular_posts_loaderincludes\functions.php:1089
authwp_ajax_cozy_block_trending_posts_loaderincludes\functions.php:1211
noprivwp_ajax_cozy_block_trending_posts_loaderincludes\functions.php:1212
authwp_ajax_cozy_block_advanced_gallery_loaderincludes\functions.php:1294
noprivwp_ajax_cozy_block_advanced_gallery_loaderincludes\functions.php:1295
authwp_ajax_cozy_block_wishlist_render_data_sidebarincludes\functions.php:1372
noprivwp_ajax_cozy_block_wishlist_render_data_sidebarincludes\functions.php:1373
authwp_ajax_cozy_block_wishlist_update_user_wishlistincludes\functions.php:1376
noprivwp_ajax_cozy_block_wishlist_update_user_wishlistincludes\functions.php:1377
authwp_ajax_cozy_block_wishlist_add_to_cartincludes\functions.php:1419
noprivwp_ajax_cozy_block_wishlist_add_to_cartincludes\functions.php:1420
authwp_ajax_cozy_block_quick_view_lightbox_renderincludes\functions.php:1440
noprivwp_ajax_cozy_block_quick_view_lightbox_renderincludes\functions.php:1441
authwp_ajax_cozy_addons_download_plugin_rollback_versionincludes\functions.php:1715
noprivwp_ajax_cozy_addons_download_plugin_rollback_versionincludes\functions.php:1716
authwp_ajax_cozy_addons_activate_rollback_versionincludes\functions.php:1757
noprivwp_ajax_cozy_addons_activate_rollback_versionincludes\functions.php:1758

REST API Routes 15

GET/wp-json/cozy-block/v1/postscore\api\class-block.php:50
GET/wp-json/cozy-block/v1/posts/stickycore\api\class-block.php:60
GET/wp-json/cozy-block/v1/tagscore\api\class-block.php:70
GET/wp-json/cozy-block/v1/commentscore\api\class-block.php:80
GET/wp-json/cozy-block/v1/related-postscore\api\class-block.php:90
GET/wp-json/cozy-block/v1/post-views/(?P<post_id>\d+)core\api\class-block.php:100
GET/wp-json/cozy-block/v1/post-comments/(?P<post_id>\d+)core\api\class-block.php:110
GET/wp-json/cozy-block/v1/post-categoriescore\api\class-block.php:120
GET/wp-json/cozy-block/v1/cf7-shortcode-contentcore\api\class-cf7.php:55
GET/wp-json/cozy-block/v1/pattern-contentcore\api\class-patterns.php:54
GET/wp-json/cozy-block/v1/template-contentcore\api\class-patterns.php:66
GET/wp-json/cozy-block/v1/page-contentcore\api\class-patterns.php:78
GET/wp-json/cozy-block/v1/product-categoriescore\api\class-woo.php:57
GET/wp-json/cozy-block/v1/products/(?P<term_id>\d+)core\api\class-woo.php:71
GET/wp-json/cozy-block/v1/productscore\api\class-woo.php:85
WordPress Hooks 77
actionadmin_noticesadmin\admin-notice.php:62
actionadmin_noticesadmin\admin-notice.php:105
actionadmin_post_cozy_addons_rollbackadmin\admin-notice.php:390
actionwp_enqueue_scriptsblocks\accordion\render.php:181
actionwp_enqueue_scriptsblocks\ad\render.php:47
actionwp_enqueue_scriptsblocks\add-to-cart\render.php:165
actionwp_enqueue_scriptsblocks\advanced-categories\render.php:471
actionwp_enqueue_scriptsblocks\advanced-gallery\render.php:767
actionwp_enqueue_scriptsblocks\advanced-tab\render.php:219
actionwp_enqueue_scriptsblocks\back-to-top\render.php:50
actionwp_enqueue_scriptsblocks\breadcrumb\render.php:61
actionwp_enqueue_scriptsblocks\categorized-post-tabs\render.php:979
actionwp_enqueue_scriptsblocks\cf7-styler\render.php:449
actionwp_enqueue_scriptsblocks\container\render.php:44
actionwp_enqueue_scriptsblocks\countdown-timer\render.php:294
actionwp_enqueue_scriptsblocks\counter\render.php:51
actionwp_enqueue_scriptsblocks\current-time\render.php:74
actionwp_enqueue_scriptsblocks\featured-content-box\render.php:168
actionwp_enqueue_scriptsblocks\featured-post\render.php:716
actionwp_enqueue_scriptsblocks\featured-post-tabs\render.php:731
actionwp_enqueue_scriptsblocks\featured-product\render.php:931
actionwp_enqueue_scriptsblocks\featured-product-tabs\render.php:1097
actionwp_enqueue_scriptsblocks\icon-list\render.php:138
actionwp_enqueue_scriptsblocks\icon-picker\render.php:68
actionwp_enqueue_scriptsblocks\img-compare\render.php:148
actionwp_enqueue_scriptsblocks\magazine-grid\render.php:1125
actionwp_enqueue_scriptsblocks\magazine-list\render.php:755
actionwp_enqueue_scriptsblocks\mega-menu\render.php:305
actionwp_enqueue_scriptsblocks\modal\render.php:160
actionwp_enqueue_scriptsblocks\news-ticker\render.php:50
actionwp_enqueue_scriptsblocks\popular-post\render.php:683
actionwp_enqueue_scriptsblocks\portfolio-gallery\render.php:851
actionwp_enqueue_scriptsblocks\portfolio-gallery-meta\render.php:146
actionwp_enqueue_scriptsblocks\post-carousel\render.php:89
actionwp_enqueue_scriptsblocks\post-comments\render.php:137
actionwp_enqueue_scriptsblocks\post-slider\render.php:50
actionwp_enqueue_scriptsblocks\post-views\render.php:135
actionwp_enqueue_scriptsblocks\pricing-table\render.php:512
actionwp_enqueue_scriptsblocks\product-carousel\render.php:236
actionwp_enqueue_scriptsblocks\product-category\render.php:334
actionwp_enqueue_scriptsblocks\product-review\render.php:530
actionwp_enqueue_scriptsblocks\product-slider\render.php:96
actionwp_enqueue_scriptsblocks\product-tab\render.php:867
actionwp_enqueue_scriptsblocks\progress-bar\render.php:148
actionwp_enqueue_scriptsblocks\quick-view\render.php:344
actionwp_enqueue_scriptsblocks\sidebar-panel\render.php:160
actionwp_enqueue_scriptsblocks\slider\render.php:43
actionwp_enqueue_scriptsblocks\social-icon\render.php:60
actionwp_enqueue_scriptsblocks\social-share\render.php:217
actionwp_enqueue_scriptsblocks\teams\render.php:81
actionwp_enqueue_scriptsblocks\testimonial\render.php:81
actionwp_enqueue_scriptsblocks\toggle-content\render.php:230
actionwp_enqueue_scriptsblocks\trending-post\render.php:672
actionwp_enqueue_scriptsblocks\wishlist\render.php:591
actioninitcore\cpt\ca-mega-menu.php:49
actioninitcore\cpt\ca-portfolio-gallery.php:50
actioninitcore\cpt\ca-portfolio-gallery.php:89
actioninitcore\cpt\ca-portfolio-gallery.php:154
actionsave_postcore\cpt\ca-portfolio-gallery.php:260
filtermanage_ca_portfolio_gallery_posts_columnscore\cpt\ca-portfolio-gallery.php:279
actionmanage_ca_portfolio_gallery_posts_custom_columncore\cpt\ca-portfolio-gallery.php:310
filterquery_loop_block_query_varscore\filters\class-query-loop.php:140
actionenqueue_block_assetscore\library\class-patterns.php:27
actionadmin_enqueue_scriptsincludes\class-admin.php:61
actionadmin_menuincludes\class-admin.php:63
actioninitincludes\class-assets.php:74
actionwp_enqueue_scriptsincludes\class-assets.php:75
actionenqueue_block_editor_assetsincludes\class-assets.php:131
actionenqueue_block_assetsincludes\class-assets.php:132
filterblock_categories_allincludes\class-blocks.php:115
actioninitincludes\class-blocks.php:117
actionrest_api_initincludes\class-core.php:103
actioninitincludes\class-i18n.php:46
actionwp_headincludes\functions.php:62
actionreset_trending_post_views_count_eventincludes\functions.php:93
filterrender_blockincludes\functions.php:2249
filterrender_blockincludes\functions.php:2395

Scheduled Events 1

reset_trending_post_views_count_event
Maintenance & Trust

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedJan 7, 2026
PHP min version7.3
Downloads243K

Community Trust

Rating90/100
Number of ratings18
Active installs7K
Alternatives

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Alternatives

Greenshift – animation and page builder blocks

Greenshift – animation and page builder blocks

greenshift-animation-and-page-builder-blocks

A
89

More than 20 special blocks for Gutenberg to build complex pages and animations with highest possible web vitals score.

70K 19 CVEs
ComboBlocks — Block Library & Page Builder

ComboBlocks — Block Library & Page Builder

combo-blocks

A
100

Landing Page Builder, Blog Builder, eCommerce Builder, Niche Site Builder, News Site Builder and More.

100 No CVEs
Spectra Gutenberg Blocks – Website Builder for the Block Editor

Spectra Gutenberg Blocks – Website Builder for the Block Editor

ultimate-addons-for-gutenberg

A
92

Power-up Gutenberg with advanced blocks for faster website creation. Build your WordPress website effortlessly using powerful building blocks!

1.0M 26 CVEs
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

kadence-blocks

A
86

20+ AI-powered Gutenberg Blocks with endless options, enabling top-notch efficiency for high-performance dynamic website creation.

600K 31 CVEs
Page Builder: Pagelayer – Drag and Drop website builder

Page Builder: Pagelayer – Drag and Drop website builder

pagelayer

A
88

The most advanced frontend drag & drop page builder. Pagelayer is a light weight but extremely powerful Website Builder.

400K 25 CVEs
Developer Profile

Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE) Developer Profile

CozyThemes

40 plugins · 32K total installs

96
trust score
Avg Security Score
94/100
Avg Patch Time
7 days
View full developer profile
Detection Fingerprints

How We Detect Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE)

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/cozy-addons/assets/css/blocks.editor.min.css/wp-content/plugins/cozy-addons/assets/js/blocks.editor.min.js/wp-content/plugins/cozy-addons/assets/css/frontend.min.css/wp-content/plugins/cozy-addons/blocks/accordion/frontend.js/wp-content/plugins/cozy-addons/blocks/advanced-heading/frontend.js/wp-content/plugins/cozy-addons/blocks/blockquote/frontend.js/wp-content/plugins/cozy-addons/blocks/button/frontend.js/wp-content/plugins/cozy-addons/blocks/call-to-action/frontend.js+80 more
Script Paths
/wp-content/plugins/cozy-addons/assets/js/cozy-block-editor.min.js/wp-content/plugins/cozy-addons/assets/js/frontend.min.js
Version Parameters
cozy-addons/assets/css/blocks.editor.min.css?ver=cozy-addons/assets/js/blocks.editor.min.js?ver=cozy-addons/assets/css/frontend.min.css?ver=cozy-addons/blocks/accordion/frontend.js?ver=cozy-addons/blocks/advanced-heading/frontend.js?ver=cozy-addons/blocks/blockquote/frontend.js?ver=cozy-addons/blocks/button/frontend.js?ver=cozy-addons/blocks/call-to-action/frontend.js?ver=cozy-addons/blocks/carousel/frontend.js?ver=cozy-addons/blocks/circle-progress/frontend.js?ver=cozy-addons/blocks/contact-form-7/frontend.js?ver=cozy-addons/blocks/countdown/frontend.js?ver=cozy-addons/blocks/divider/frontend.js?ver=cozy-addons/blocks/divider-one/frontend.js?ver=cozy-addons/blocks/dual-heading/frontend.js?ver=cozy-addons/blocks/flip-box/frontend.js?ver=cozy-addons/blocks/google-map/frontend.js?ver=cozy-addons/blocks/gallery/frontend.js?ver=cozy-addons/blocks/image-box/frontend.js?ver=cozy-addons/blocks/instagram/frontend.js?ver=cozy-addons/blocks/list/frontend.js?ver=cozy-addons/blocks/modal-popup/frontend.js?ver=cozy-addons/blocks/navigation-menu/frontend.js?ver=cozy-addons/blocks/number-counter/frontend.js?ver=cozy-addons/blocks/post-grid/frontend.js?ver=cozy-addons/blocks/post-slider/frontend.js?ver=cozy-addons/blocks/price-table/frontend.js?ver=cozy-addons/blocks/progressbar/frontend.js?ver=cozy-addons/blocks/pricing-table/frontend.js?ver=cozy-addons/blocks/section/frontend.js?ver=cozy-addons/blocks/slider/frontend.js?ver=cozy-addons/blocks/social-share/frontend.js?ver=cozy-addons/blocks/tabs/frontend.js?ver=cozy-addons/blocks/testimonial/frontend.js?ver=cozy-addons/blocks/testimonial-slider/frontend.js?ver=cozy-addons/blocks/timeline/frontend.js?ver=cozy-addons/blocks/tooltip/frontend.js?ver=cozy-addons/blocks/video/frontend.js?ver=cozy-addons/blocks/woo-add-to-cart/frontend.js?ver=cozy-addons/blocks/woo-products/frontend.js?ver=cozy-addons/blocks/woo-search/frontend.js?ver=cozy-addons/blocks/woo-categories/frontend.js?ver=cozy-addons/assets/js/frontend.min.js?ver=

HTML / DOM Fingerprints

CSS Classes
cozy-accordion-wrapcozy-accordion-itemcozy-accordion-headercozy-accordion-contentcozy-advanced-heading-wrapcozy-blockquote-wrapcozy-button-wrapcozy-cta-wrap+35 more
HTML Comments
<!-- wp:cozy-addons/accordion --><!-- wp:cozy-addons/advanced-heading --><!-- wp:cozy-addons/blockquote --><!-- wp:cozy-addons/button -->+35 more
Data Attributes
data-block-client-iddata-cozy-accordiondata-cozy-tabsdata-cozy-sliderdata-cozy-carouseldata-cozy-testimonial-slider+1 more
JS Globals
window.cozyBlockAccordionInitcozyAccordion_window.cozyBlockTabsInitcozyTabs_window.cozyBlockSliderInitcozySlider_+8 more
FAQ

Frequently Asked Questions about Cozy Blocks – All-in-One Website Builder with Gutenberg Blocks, 500+ Patterns and 40+ Homepage Templates for Full Site Editing (FSE)