StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

• CVE-2026-104762 Medium 6.4 Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute 0.2%
• CVE-2026-18062 Medium 6.4 Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content 0.4%
• CVE-2026-18435 Medium 6.4 Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute 0.3%
• CVE-2026-15286 Medium 4.3 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication 0.4%
• CVE-2026-12902 Medium 4.3 Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions 0.5%
• CVE-2026-12904 Medium 4.3 Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter 0.5%
• CVE-2026-11357 Medium 4.3 Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization 0.3%
• CVE-2026-2826 Medium 4.3 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload 0.3%
• CVE-2026-2633 Medium 4.3 Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload 0.4%
• CVE-2026-1857 Medium 4.3 Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter 0.3%
• CVE-2026-2608 Medium 4.3 Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization 0.2%
• CVE-2025-5678 Medium 6.4 Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter 0.3%
• CVE-2025-1291 Medium 6.4 Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' 0.3%
• CVE-2024-12304 Medium 6.4 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link 0.2%
• CVE-2024-12581 Medium 4.4 Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting 0.5%
• CVE-2024-10785 Medium 6.4 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
• CVE-2024-9655 Medium 6.4 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget 0.3%
• CVE-2024-5819 Medium 6.4 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes 0.3%
• CVE-2024-5289 Medium 6.4 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget 0.3%
• CVE-2024-4863 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter 0.5%
• CVE-2024-4208 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect 0.3%
• CVE-2024-3189 Medium 5.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
• CVE-2024-4209 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer 0.4%
• CVE-2024-4481 Medium 6.4 Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link 0.3%
• CVE-2024-2273 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-1999 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget 0.5%
• CVE-2023-6964 High 8.5 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) 0.4%
• CVE-2024-0598 Medium 4.4 Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings 0.7%
• CVE-2024-2919 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget 0.3%
• CVE-2024-1541 Medium 6.4 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%