Kadence Blocks CVE-2026-18435

Exploitation requires an authenticated WordPress account with at least contributor-level access; the CVSS PR:L metric confirms this. The Kadence Blocks plugin must be installed and active on the target site with versions at or below 3.7.8. The attacker must have the ability to create or edit pages or posts that include the Table of Contents block with the toggleIcon attribute. Exploitation is limited by: the requirement for a pre-existing contributor (or higher) account-unauthenticated attackers cannot exploit this; the victim must load a page containing the injected block for the XSS payload to execute; and the impact is bounded by the victim's browser session rather than the server-side WordPress process. No special non-default server configuration is required beyond having the plugin installed.

The CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) accurately reflects the attack profile: network-reachable, low complexity, and requiring only contributor-level credentials with no user interaction needed from the attacker to store the payload. The scope change to victim browsers is the most significant risk multiplier-successful exploitation can compromise administrator sessions if an admin visits the injected page, which could escalate impact far beyond the C:L/I:L ratings. No EPSS data was provided, and neither a CISA KEV listing nor public POC code is present in the intelligence data, suggesting this has not yet seen widespread automated exploitation. However, Wordfence reporting indicates active vulnerability research coverage, and contributor accounts are common on news sites, blogs, and multi-author platforms, making the PR:L prerequisite practically achievable in many target environments. The real-world risk is moderate-to-elevated on high-traffic or multi-author WordPress deployments where contributor access is broadly distributed.

An attacker with an existing contributor account on a WordPress site running Kadence Blocks 3.7.8 or earlier creates a new page, inserts a Table of Contents block, and sets the toggleIcon attribute to a JavaScript payload. Once the page is published, any authenticated user-including administrators-who visits it will have the payload silently execute in their browser, enabling the attacker to steal session cookies and escalate to full site administration. No public POC code is identified at time of analysis, but the attack technique is well-understood for this CWE class.