WordPress security changelog
MEDIUM CVE-2026-104762 Deferred

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Cross-site scripting

An Author or higher can save script-bearing font-family data that becomes executable during rendering when the nondefault load_fonts_local option is enabled. Without that configuration the described path is not established. The export does not name the save endpoint or rendering function. Affected versions: <= 3.7.12.

CVE / CNA score 6.4 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Plugin slug
kadence-blocks
Affected
<= 3.7.12
Safe version
See mitigation notes
Published
Oct 10, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Oct 10, 2026 and is one of 25 known issues for this plugin.

What to do

Update, patch or deactivate.

This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Disable the affected feature or deactivate the component until a confirmed fix is available. Application-level remediation: Allowlist font-family values and escape them appropriately when generating markup and local-font output. Official author release notes: https://wordpress.org/plugins/kadence-blocks/.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This encoding bypass is only triggered when the "Load Google Fonts Locally" site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, which is not the default configuration.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources