Kadence Blocks CVE-2026-105890

Exploitation requires an authenticated WordPress account with at least contributor/author-level posting privileges (PR:L) so the attacker can create or edit content using Kadence Blocks, and it requires a privileged victim (UI:R) - typically an administrator or editor - to subsequently view or preview the attacker's stored content in a context that renders the unsanitized block input. Limiting factors: the attack fails without the ability to register or obtain a content-creation account and without a higher-privileged user interacting with the malicious content; it affects installations running Gutenberg Blocks by Kadence Blocks version 3.7.12 or earlier. It is not remote-unauthenticated: a site that restricts content creation to trusted users substantially narrows the exposure.

This is a moderate-priority, not a top-tier, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) tells a consistent story for a stored XSS: network-reachable and low-complexity, but it requires an authenticated low-privilege account (PR:L) AND victim user interaction (UI:R, typically an administrator or editor later viewing the stored content), with a changed scope (S:C) reflecting execution in the victim's browser context. Only Low confidentiality/integrity/availability impact is claimed. No EPSS score, SSVC decision, KEV listing, or POC reference was provided in the input, so exploitation probability cannot be quantified; based on available signals this is 'no public exploit identified at time of analysis.' The two authentication/interaction gates (a valid contributor-level-or-higher account plus a privileged victim action) meaningfully reduce real-world risk below what the 6.5 score alone might suggest, placing it firmly in routine-patch rather than emergency territory. Note: EPSS and KEV data are absent from the input, not confirmed-negative - treat the lack of exploitation evidence as 'unknown/unreported,' not 'proven unexploited.'

An attacker who already holds a low-privilege WordPress account (e.g., contributor or author) crafts a post or page using a Kadence block and injects malicious script into an unsanitized block field. The payload is stored, and when an administrator or other privileged user later opens or previews that content in wp-admin, the script executes in their authenticated browser session, enabling session/cookie theft or admin actions. No public proof-of-concept is referenced in the provided data.