Kadence Blocks CVE-2026-115602

Exploitation requires an authenticated WordPress account with low privileges (CVSS PR:L - typically a content-contributing role such as contributor or author that can submit block content) on a site running Gutenberg Blocks by Kadence Blocks up to and including version 3.8.0.1. The stored payload only executes when another user views the injected content (CVSS UI:R), so a separate victim interaction - generally a higher-privileged user such as an administrator rendering the affected page - is needed to trigger impact. The specific vulnerable block, field, or parameter is not described in the available sources. Limiting factors: the need for a pre-existing authenticated account substantially reduces exposure on single-admin or tightly controlled sites, and the user-interaction dependency means no impact occurs until the stored content is viewed.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) in the Kadence Blocks WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable but not fully unauthenticated exploitation: PR:L requires the attacker to already hold a low-privileged authenticated account, and UI:R means a victim (typically a higher-privileged user such as an administrator) must view the injected content for the payload to fire. The S:C (scope change) reflects that injected script executes in the victim's browser context, outside the component that stored it. No EPSS probability is provided in the input, there is no CISA KEV listing, and no verified working exploit code is referenced - the only reference is the Patchstack advisory itself. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with an authenticated, user-interaction-dependent XSS rather than a wormable or mass-exploitable flaw. Net assessment: a real but second-tier priority - genuinely exploitable in multi-author WordPress environments where lower-privileged users can inject content, but gated by both an authenticated account and victim interaction, so not a drop-everything emergency. Missing EPSS and absence of KEV are notable gaps but do not change the triage conclusion.

An attacker holding a low-privileged authenticated account (e.g. contributor or author) on a WordPress site running Kadence Blocks injects a malicious script payload into a block field that is not properly sanitized. The payload is stored and later rendered when a higher-privileged user, such as an administrator, views the affected page in the dashboard or on the front end, executing attacker-controlled JavaScript in that user's session. No verified working exploit code is referenced in the available sources, only the Patchstack advisory.