stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
30 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-104762 | ≤ 3.7.12 | Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-18435 | ≤ 3.7.8 | Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-18062 | ≤ 3.7.8.1 | Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content | MEDIUM 6.4 | 0.4 % | ||
| CVE-2026-15286 | ≤ 3.5.32 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post P… | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-12902 | ≤ 3.7.7 | Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_pr… | MEDIUM 4.3 | 0.5 % | ||
| CVE-2026-12904 | ≤ 3.7.7 | Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modific… | MEDIUM 4.3 | 0.5 % | ||
| CVE-2026-11357 | ≤ 3.7.5 | Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-2826 | ≤ 3.6.3 | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-2633 | ≤ 3.6.1 | Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-1857 | ≤ 3.6.1 | Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-2608 | ≤ 3.5.32 | Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-5678 | ≤ 3.5.10 | Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `red… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2025-1291 | ≤ 3.4.9 | Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-12304 | ≤ 3.4.2 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Bu… | MEDIUM 6.4 | 0.2 % | ||
| CVE-2024-12581 | ≤ 3.2.53 | Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting | MEDIUM 4.8 | 0.5 % | ||
| CVE-2024-10785 | ≤ 3.3.3 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | MEDIUM 6.4 | 0.4 % | ||
| CVE-2024-9655 | ≤ 3.3.1 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ic… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-5819 | ≤ 3.2.45 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scrip… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-5289 | ≤ 3.2.42 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Go… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-4863 | ≤ 3.2.38 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via title… | MEDIUM 6.4 | 0.5 % | ||
| CVE-2024-4208 | ≤ 3.2.37 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-3189 | ≤ 3.2.37 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-4209 | ≤ 3.2.36 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count… | MEDIUM 6.4 | 0.4 % | ||
| CVE-2024-4481 | ≤ 3.2.36 | Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-2273 | ≤ 3.2.34 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-1999 | ≤ 3.2.25 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testi… | MEDIUM 6.4 | 0.5 % | ||
| CVE-2023-6964 | ≤ 3.1.26 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) | HIGH 8.5 | 0.4 % | ||
| CVE-2024-0598 | ≤ 3.2.17 | Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings | MEDIUM 4.8 | 0.7 % | ||
| CVE-2024-2919 | ≤ 3.2.31 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-1541 | ≤ 3.2.23 | Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting | MEDIUM 6.4 | 0.5 % |