Cozy Blocks: Gutenberg blocks and FSE templates

Name: Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
Availability: InStock
Rating: 4.6 (21 reviews)
Author: CozyThemes

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates

Provides a collection of Gutenberg blocks and ready-made site patterns as an alternative to traditional page builders. With over 7,000 active installations and a 4.6-star rating, this tool supports both standard block editing and full-site editing workflows.

#1,104 Global Rank

6K+ active installs

4.6/5 21 ratings

Since 2022 4 years active

Vulnerabilities

11 Total

11 Patched

0 Active

100% Resolved rate

Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.2.11 Patched in ✓ 2.2.12 Published 31 Jul 2026 CVE CVE-2026-15950

Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.2.11 Patched in ✓ 2.2.12 Published 28 Jul 2026 CVE CVE-2026-15393

Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.2.11 Patched in ✓ 2.2.12 Published 23 Jul 2026 CVE CVE-2026-15334

Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.2.11 Patched in ✓ 2.2.12 Published 23 Jul 2026 CVE CVE-2026-15333

Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution

CWE-94 · Improper Control of Generation of Code ('Code Injection')

The The Cozy Blocks – All-in-One Page Builder Blocks for Gutenberg and Full Site Editing (FSE) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.29. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

6.5 Medium Affected All – 2.1.29 Patched in ✓ 2.1.30 Published 22 Sep 2025 CVE CVE-2025-59573

Cozy Blocks <= 2.1.22 - Missing Authorization

CWE-862 · Missing Authorization

The Cozy Blocks – Page Builder for Gutenberg & Site Editor with Post Blocks, WooCommerce Blocks, Magazine Blocks & WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.1.22. This makes it possible for unauthenticated attackers to get post details.

5.3 Medium Affected All – 2.1.22 Patched in ✓ 2.1.23 Published 7 May 2025 CVE CVE-2025-47485

Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.1.6 Patched in ✓ 2.1.7 Published 27 Mar 2025 CVE CVE-2025-30838

Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.0.18 Patched in ✓ 2.0.19 Published 25 Oct 2024 CVE CVE-2024-50502

Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.0.15 Patched in ✓ 2.0.16 Published 24 Oct 2024 CVE CVE-2024-50441

Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Cozy Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.0.11 Patched in ✓ 2.0.12 Published 30 Sep 2024 CVE CVE-2024-47355

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

6.1 Medium Affected All – 1.2.3 Patched in ✓ 1.2.4 Published 18 Jul 2023 CVE CVE-2023-33999

About Cozy Blocks

Build any WordPress site without Elementor or Divi. 57 Gutenberg blocks, 700+ ready-made patterns & 50+ FSE templates. No page builder needed.

Cozy Blocks is a powerful Gutenberg page builder plugin that extends the WordPress Block Editor with 57 advanced blocks, 700+ professionally designed block patterns across 20+ categories, and 50+ complete FSE homepage templates for 12 niches — all native to the WordPress Site Editor.

No Elementor. No Divi. No shortcodes. Just fast, clean, native blocks that work exactly the way WordPress is built to work.

Whether you’re a freelancer building client sites, a blogger setting up a magazine layout, or a store owner who needs powerful WooCommerce blocks — Cozy Blocks has everything in one install.

⚠️ IMPORTANT: Cozy Blocks works exclusively with block-based (FSE) WordPress themes. It does not support the Classic Editor or classic PHP themes.

Compatible with any modern block theme — including SaasLauncher, Homelancer, Jetnews Magazine, WoxStore, and all FSE themes on WordPress.org. Not sure if your theme is FSE-compatible? Check under Appearance Editor in your dashboard. If the Site Editor loads, you’re good to go.

Try Cozy Blocks on a dummy site!

Quick Links

Key Features That Enhance and Extend WordPress Blocks

Design Library Kit
50+ Advanced Blocks to Extend the Site Editor
WooCommerce Blocks
Post and Magazine Blocks
Slider Blocks (Slider & Carousel Blocks)
Team Block
Testimonial Block
Pricing Table
Portfolio Block (Dynamic Portfolio and Gallery Builder)
Popup Builder Block
Social Media/Share Icons Blocks
Responsive Visibility Conditions
Animation on Scroll
Advanced Hover Effect for Blocks
Google Fonts for Blocks
Advanced Content Section builder (Tabs, Accordion, Counter and Progress Bar)
Ajax Loader for Post Blocks
Advanced Gallery with multiple layouts

Cozy Blocks is an essential WordPress plugin that revolutionizes Full Site Editing with Gutenberg. Seamlessly integrated with both FSE (Full Site Editing) and the Gutenberg editor, it offers a robust library of over 50 advanced, customizable Gutenberg blocks. Designed for ease of use, Cozy Blocks caters to both experienced developers and beginners, enabling users to effortlessly design dynamic, visually stunning websites.

Whether you’re building an e-commerce store, a news platform, a corporate site, or any other type of web presence, Cozy Blocks provides the powerful tools you need. Supported by flexible customization options and robust support, this plugin empowers you to embrace the future of web design and unlock your creative potential.

Join the Cozy Blocks movement today and build your website with ease.

Watch our step-by-step tutorial on installing Cozy Blocks!

🎨 Design Library — 700+ Patterns & 50+ Full Site Templates

The largest ready-made design library for the WordPress Block Editor. Every pattern and template is 100% native to Gutenberg — no imports, no proprietary formats, no lock-in.

⚡ 58 Advanced Gutenberg Blocks — Built for the Block Editor & FSE

Every block is built natively for the WordPress Site Editor. No legacy shortcode wrappers, no inline JavaScript hacks — clean semantic markup that loads only what your page actually uses.

Utility:
Date & Time | Contact Form 7 Styler | Cozy Button

🚀 Built-in Power Features — Available on WordPress core blocks

Scroll Animations — Add entrance animations (fade, slide, zoom, flip) to any block or section. No CSS knowledge required.
Hover Effects — Apply interactive hover transitions to buttons, images, cards, and containers directly from block settings.
Responsive Visibility Controls — Show or hide any block on desktop, tablet, or mobile from a single toggle. Build truly device-specific layouts without duplication.
Block Enable/Disable Manager — Only the blocks you activate load on the front end. No unused JavaScript or CSS is shipped to your visitors. Core Web Vitals stay clean.
Google Fonts Integration — Access the complete Google Fonts library inside the block editor with live preview. No API key required.
AJAX-Powered Post Blocks — Post grids, magazine layouts, and post carousels load content dynamically. Pages stay fast even with content-heavy layouts.

Getting Started with Cozy Blocks — Watch the Walkthrough

License

This plugin is licensed under the GPLv2 or later license. See LICENSE for more details.

Screenshots

Gutenberg Blocks Collection

Blocks Enable/Disable Option

Block Patterns

WooCommerce Blocks

Post and Magazine Blocks

Marketing and Social Blocks

Advanced utility features like Animation and Hover Effects

FSE Homepage templates

Frequently Asked Questions

What is Cozy Blocks?

Cozy Blocks is a powerful WordPress plugin that offers 50+ advanced Gutenberg blocks built specifically for the Full Site Editing (FSE) experience. It allows you to design complete websites visually — including post grids, WooCommerce layouts, galleries, portfolios, and more — all without using third-party page builders or custom code.

Is Cozy Blocks compatible with all WordPress themes?

Cozy Blocks is only compatible with block-based (FSE) WordPress themes. It does not support classic themes or the Classic Editor. To get the full benefits of Cozy Blocks, you must use it with a modern block theme like SaasLauncher, Jetnews Magazine, WoxStore, or any compatible Full Site Editing theme available on WordPress.org.

Is Cozy Blocks a replacement for Elementor or Divi?

Yes — for block-theme users. Cozy Blocks gives you the same design capabilities (hero sections, pricing tables, sliders, mega menus, popups, WooCommerce layouts) inside the native WordPress Block Editor, without installing a separate page builder. If your site uses a modern FSE block theme, Cozy Blocks replaces everything Elementor and Divi do, while being significantly faster and lighter.

Building client websites as a freelancer or agency?

Import a complete homepage template for your client’s niche in one click, then customize it fully inside the Site Editor. No third-party dependencies.

Running a WooCommerce store?

Product grids, category blocks, quick view, wishlist, product sliders, and add-to-cart blocks work natively without extra plugins.

Publishing a blog, news site, or magazine?

Post grids, news tickers, trending posts, magazine-style layouts, and categorized post tabs are all included — no theme dependency.

New to WordPress?

The 700+ ready-made patterns and 50+ homepage templates mean you can start with a professionally designed page, not a blank screen.

Will Cozy Blocks slow down my website?

No. The built-in Block Manager lets you enable only the blocks your site actually uses. Any disabled block loads zero scripts or styles on the front end. Sites built with Cozy Blocks regularly achieve 90+ PageSpeed scores.

Can I customize the appearance of Cozy Blocks?

Yes, Cozy Blocks offers advanced styling controls for each block — including typography, color, spacing, alignment, visibility, and device-specific settings. You can fully customize how your site looks and feels directly within the Site Editor, and even use global styles from your theme for consistency.

Is Cozy Blocks for Free?

The free version offers 30+ essential Full Site Editing (FSE) blocks — perfect for creating custom layouts, content sections, and WooCommerce pages.

For users who want more power and flexibility, a Pro version is available with 50+ premium blocks that include advanced features, enhanced design controls, and extended support for WooCommerce and dynamic content.

Where can I get support or ask questions?

You can get support for Cozy Blocks via the support forum. You can also ask pre-sale questions, or request features through the official support channels provided by CozyThemes, the plugin’s developer.

Where do I report security bugs?

You can report any security bugs found in the source code of this plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment and take care of notifying the developers of this plugin.

Alternatives to Cozy Blocks