EUVD-2026-51749
GHSA-rvrh-6m8r-3gjw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R selected because stored XSS payload execution requires a victim to visit the injected page; all other metrics align with the described contributor-level, network-accessible, cross-session stored XSS.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block's urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached.
AnalysisAI
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: insufficient input sanitization and output escaping within the PHP rendering pipeline for the Kadence Identity Block. The flaw is localized to the build_html() method in class-kadence-blocks-identity-block.php, with vulnerable lines directly observable in the WordPress Plugin Trac browser at lines 108, 117, and 162 in both the 3.7.2 and 3.7.8 tagged releases. Gutenberg passes block attribute data - including the urlTransparent flag and inner image content - server-side to PHP rendering functions; the missing esc_attr() or wp_kses() calls on that content allow raw attacker-supplied HTML and JavaScript to flow into the rendered page output. The CPE string cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:* confirms the vendor is StellarWP and the wildcard version indicates all releases are affected up to the ceiling specified in the description. The CVSS S:C (Scope Changed) metric correctly reflects that the plugin's server-side code vulnerability propagates impact into an entirely separate security scope - the victim's browser session.
RemediationAI
Update the Kadence Blocks plugin to a version beyond 3.7.8.1 immediately; a code-level fix has been committed and is visible in the WordPress Plugin SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3627652%40kadence-blocks&new=3627652%40kadence-blocks, though the exact released patch version number is not independently confirmed from the available intelligence data - verify the current available version on the plugin's WordPress.org listing before updating. As an interim compensating control, restrict contributor-level access exclusively to fully trusted internal users, directly eliminating the attacker's authentication prerequisite; note this may limit site content workflows. Administrators can also remove or disable the Kadence Identity Block from the site's allowed block list via theme configuration or a block management plugin, which prevents the vulnerable build_html() path from being reachable at all - at the cost of losing that block's functionality. A WAF rule targeting script-pattern injection in Gutenberg block content fields can provide detection coverage but should not substitute for patching, as stored XSS bypasses are common against pattern-based filters.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated con
Kadence Blocks WordPress plugin versions up to and including 3.7.7 allows authenticated Contributor-level users to read
Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributo
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authentica
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypas
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today