What is the CVSS score of CVE-2026-11357?

CVE-2026-11357 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kadence Blocks CVE-2026-11357

EUVD-2026-37843 MEDIUM

Information Exposure (CWE-200)

2026-06-18 Wordfence

GHSA-g255-vwqv-qh7v

WordPress Information Disclosure Kadence Blocks Page Builder Toolkit For Gutenberg Editor Wordpress Plugin Stellarwp

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor authentication (PR:L) is mandatory; exposure is client-side credential read-only with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 06:19 vuln.today

CVE Published

Jun 18, 2026 - 04:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editor_assets_variables. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's connected Kadence account license key, license owner email, api_key, api_email, and license domain from the browser console by inspecting window.kadence_blocks_params.proData. Exploitation requires only that an administrator has previously connected a valid Kadence license; the full credential bundle is then readable by any Contributor-level user from the block editor client context without any server-side request manipulation.

AnalysisAI

Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authenticated contributors to read the site's Kadence license key, license owner email, api_key, api_email, and license domain directly from the browser console via the JavaScript global window.kadence_blocks_params.proData. The credentials are serialized client-side through the editor_assets_variables mechanism and require no server-side manipulation to extract. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Kadence Blocks is a Gutenberg block editor toolkit published by StellarWP (CPE: cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:*). The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin's PHP class class-kadence-blocks-editor-assets.php serializes Pro license credentials into a JavaScript variable (kadence_blocks_params.proData) that is injected into the block editor page payload. The referenced source at L291 and L337 of that class, combined with helper-functions.php:L286, shows the credential bundle is constructed from stored site options and passed to the front-end without any role-gating on the disclosure. Any authenticated WordPress user with access to the block editor - including the Contributor role - can inspect window.kadence_blocks_params in the browser developer console and retrieve the full credential set without making any additional HTTP requests.

RemediationAI

An upstream fix has been committed to the Kadence Blocks repository per Trac changeset 3569191 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3569191%40kadence-blocks&new=3569191%40kadence-blocks); however, a specific released patched version number is not confirmed from the available input data. Site administrators should update the Kadence Blocks plugin to the latest available version via the WordPress plugin dashboard immediately and verify the installed version exceeds 3.7.5. As an interim compensating control, restrict the Contributor role from accessing the block editor entirely if not operationally required - this eliminates the exposure surface without disabling the plugin, though it may impact content creation workflows. Additionally, after patching, rotate the exposed Kadence license key and api_key through the Kadence account portal to invalidate any credentials that may have already been read by lower-privileged users; failure to rotate credentials after a known exposure leaves the account at continued risk regardless of the code fix.