EUVD-2026-51748
GHSA-q7wg-wgwc-vhh2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS auto-executes on page load (UI:N); contributor account required (PR:L); scope changes to victim browser (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.
Technical ContextAI
The vulnerability resides in the StellarWP Kadence Blocks plugin (CPE: cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:*), a Gutenberg block editor extension for WordPress. Affected code paths are identified in two Table of Contents block class files: class-kadence-blocks-table-of-contents.php (line 936) and class-kadence-blocks-table-of-contents-block.php (line 293), indicating the toggleIcon attribute is processed within the TOC block's rendering pipeline. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied attribute values are written into rendered HTML without adequate sanitization before storage or escaping before output, permitting raw script tags or event-handler payloads to survive the render cycle. WordPress contributors can create and publish content but are not expected to submit unfiltered HTML-this vulnerability bypasses that trust boundary.
RemediationAI
An upstream code change is documented in the WordPress plugin Subversion repository at changeset 3624906 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3624906%40kadence-blocks&new=3624906%40kadence-blocks); however, the exact patched plugin release version is not independently confirmed in the available data-verify the current release version via the WordPress.org plugin directory before updating. Site administrators should update Kadence Blocks to the latest available version immediately. As a compensating control where immediate patching is not feasible, restrict contributor-level account creation and audit existing contributor accounts to minimize the attacker pool; note this does not eliminate risk from already-compromised or malicious insider contributor accounts. A Web Application Firewall (WAF) rule targeting stored XSS patterns in Gutenberg block attribute payloads can provide partial mitigation, though WAF bypass is possible with obfuscated payloads. Disabling the toggleIcon feature within the Table of Contents block is a targeted workaround if the feature is not in active use.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated con
Kadence Blocks WordPress plugin versions up to and including 3.7.7 allows authenticated Contributor-level users to read
Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributo
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authentica
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypas
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today