WordPress security by component

Gutenberg Blocks with AI by Kadence WP – Page Builder Features

Plugin description

Gutenberg Blocks with AI by Kadence WP – Page Builder Features adds Gutenberg blocks and layout elements for building customized WordPress page content and website sections.

Gutenberg Blocks with AI by Kadence WP – Page Builder Features (kadence-blocks) is a WordPress plugin with 25 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 7.7.

Plugin slug: kadence-blocks

Latest vulnerability

CVE-2026-39742: Gutenberg Blocks by Kadence Blocks: Stored cross-site scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 3.8.0.2.

PublishedOct 29, 2026

Known safe version3.8.1

Published vulnerabilities for kadence-blocks
		Safe version
Oct 29, 2026	CVE-2026-39742 Gutenberg Blocks by Kadence Blocks: Stored cross-site scripting Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 3.8.0.2.	3.8.1	CVE6.5
Oct 26, 2026	CVE-2026-115602 Gutenberg Blocks by Kadence Blocks: Stored cross-site scripting Gutenberg Blocks by Kadence Blocks <= 3.8.0.1 permits stored cross-site scripting: attacker-controlled content is persisted and later rendered without sufficient neutralization, allowing script to execute in a viewer’s browser under the affected site’s origin. The supplied CVSS vector requires a low-privilege authenticated attacker and victim interaction, but the export does not identify the minimum WordPress role, editable field, endpoint or rendering function. The resulting access is bounded by the viewing user’s browser context; an administrator victim or complete site takeover is not established.	3.8.0.2	CVE6.5
Oct 10, 2026	CVE-2026-104762 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Cross-site scripting An Author or higher can save script-bearing font-family data that becomes executable during rendering when the nondefault load_fonts_local option is enabled. Without that configuration the described path is not established. The export does not name the save endpoint or rendering function. Affected versions: <= 3.7.12.	See mitigation notes	CVE6.4
Oct 08, 2026	CVE-2026-105890 Gutenberg Blocks by Kadence Blocks: Stored cross-site scripting The supplied vector requires an authenticated attacker with low privileges; the exact WordPress role is not identified. Attacker-controlled content is stored and later rendered without sufficient neutralization, allowing script execution under the site origin when a victim views the affected output. The export does not identify the write endpoint, field, rendering function or victim role; an administrator session is exposed only if that user encounters the content. The vector reports low confidentiality impact, low integrity impact, low availability impact. Affected versions: <= 3.7.12. The authoritative export identifies 3.7.12.1 as fixed for this CVE.	3.7.12.1	CVE6.5
Oct 04, 2026	CVE-2026-103354 Kadence Blocks: Unauthenticated stored cross-site scripting Kadence Blocks through 3.7.11.1 permits stored cross-site scripting. The authoritative CVSS vector requires no attacker privileges and does require victim interaction. Attacker-controlled data can persist and later execute as script when a victim encounters the affected output. The authoritative export does not identify the submission endpoint, stored field, block, rendering function, victim role or configuration prerequisites; the exact unauthenticated storage path is not disclosed. The export identifies 3.7.12 as the fixed release.	3.7.12	CVE7.1
Aug 06, 2026	CVE-2026-66696 Kadence Blocks exposes sensitive data to Contributors A logged-in Contributor can retrieve sensitive data through Kadence Blocks 3.7.8 and earlier.	3.7.8.1	CVE4.3
Aug 01, 2026	CVE-2026-18435 Kadence table-of-contents icons let Contributors store JavaScript Kadence Blocks through 3.7.8 insufficiently sanitizes and escapes the table-of-contents toggleIcon block attribute. A Contributor can store a payload that executes whenever a visitor or Administrator views the affected page.	> 3.7.8	CVE6.4
Aug 01, 2026	CVE-2026-18062 Kadence Identity image content lets Contributors store JavaScript Kadence Blocks through 3.7.8.1 insufficiently sanitizes and escapes Identity block inner-image content in build_html(). A Contributor can store JavaScript that executes for page viewers when urlTransparent is non-empty.	> 3.7.8.1	CVE6.4
Jul 10, 2026	CVE-2026-15286 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: A security weakness Kadence Blocks — Page Builder Toolkit for Gutenberg Editor is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.5.32.	3.7.8	CVE4.3
Jul 01, 2026	CVE-2026-12904 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Broken access control Kadence Blocks — Page Builder Toolkit for Gutenberg Editor is affected by broken access control. Exploitation requires an authenticated contributor account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 3.7.7.	3.7.8	CVE4.3
Jul 01, 2026	CVE-2026-12902 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: A security weakness Kadence Blocks — Page Builder Toolkit for Gutenberg Editor is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.7.7.	See mitigation notes	CVE4.3
Jun 18, 2026	CVE-2026-11357 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Sensitive information exposure Kadence Blocks — Page Builder Toolkit for Gutenberg Editor is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 3.7.5.	See mitigation notes	CVE4.3
Apr 04, 2026	CVE-2026-2826 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: A security weakness Kadence Blocks — Page Builder Toolkit for Gutenberg Editor is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.3.	3.7.9.1 (confirmed by; first fixed release not established)	CVE4.3
Feb 18, 2026	CVE-2026-2633 Gutenberg Blocks with AI by Kadence WP: A security weakness Gutenberg Blocks with AI by Kadence WP is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Feb 18, 2026	CVE-2026-1857 Gutenberg Blocks with AI by Kadence WP: Server-side request forgery Gutenberg Blocks with AI by Kadence WP is affected by server-side request forgery. Exploitation requires an authenticated contributor account. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE4.3
Jul 09, 2025	CVE-2025-5678 Gutenberg Blocks with AI by Kadence WP – Page Builder Features: Cross-site scripting Gutenberg Blocks with AI by Kadence WP – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 01, 2025	CVE-2025-1291 Gutenberg Blocks with AI by Kadence WP – Page Builder Features: Cross-site scripting Gutenberg Blocks with AI by Kadence WP – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Nov 01, 2024	CVE-2024-9655 Gutenberg Blocks with AI by Kadence WP – Page Builder Features: Cross-site scripting Gutenberg Blocks with AI by Kadence WP – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Jun 27, 2024	CVE-2024-5289 Gutenberg Blocks with AI by Kadence WP – Page Builder Features: Cross-site scripting Gutenberg Blocks with AI by Kadence WP – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Jun 14, 2024	CVE-2024-4863 Gutenberg Blocks with AI by Kadence WP – Page Builder Features: Cross-site scripting Gutenberg Blocks with AI by Kadence WP – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 14, 2024	CVE-2024-4209 Gutenberg Blocks with AI by Kadence WP – Page Builder Features: Cross-site scripting Gutenberg Blocks with AI by Kadence WP – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Apr 09, 2024	CVE-2024-1999 Gutenberg Blocks by Kadence Blocks – Page Builder Features: Cross-site scripting Gutenberg Blocks by Kadence Blocks – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Apr 02, 2024	CVE-2024-24888 Gutenberg Blocks by Kadence Blocks: Server-side request forgery Gutenberg Blocks by Kadence Blocks is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE6.4
Mar 28, 2024	CVE-2024-23500 Gutenberg Blocks by Kadence Blocks: Server-side request forgery Gutenberg Blocks by Kadence Blocks is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE7.7
Mar 13, 2024	CVE-2024-1541 Gutenberg Blocks by Kadence Blocks – Page Builder Features: Cross-site scripting Gutenberg Blocks by Kadence Blocks – Page Builder Features is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers