Kadence Blocks CVE-2026-39742

Exploitation requires an authenticated WordPress account with at least low-level posting privileges (PR:L - e.g., contributor/author able to insert Kadence blocks) to store the malicious payload, AND a subsequent victim (such as an administrator or site visitor) must view the affected content for the script to fire (UI:R). The exact vulnerable block or input field is not described in the available sources. Limiting factors that reduce real-world risk: the need for a pre-existing authenticated account, the dependency on victim interaction, and the requirement that the Kadence Blocks plugin (version up to and including 3.8.0.2) be installed and in use. These constraints make opportunistic mass exploitation unlikely relative to an unauthenticated flaw.

This is a moderate-severity Stored XSS (CWE-79) in the Kadence Blocks WordPress plugin, rated CVSS 6.5 by Patchstack. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that requires an authenticated low-privilege account (PR:L) AND victim interaction (UI:R, a user rendering the poisoned content), with a scope change (S:C) reflecting that injected script executes in another security context (e.g., an administrator's browser session). Prioritization signals are mixed and partly absent: the vuln.today decision label is 'this_month' (a mid-tier, not act_now/emergency, urgency), there is NO CISA KEV listing, NO EPSS score is supplied in the input, and NO proof-of-concept or exploit code is referenced - the only reference is the Patchstack vulnerability database entry itself. Taken together these signals describe a real but non-emergency issue: the dual prerequisites of a low-privilege authenticated session plus user interaction meaningfully constrain mass exploitation, so this is better treated as a 'patch on the normal monthly cycle' item than a drop-everything priority, consistent with the 'this_month' label. The absence of an EPSS value means exploitation-probability cannot be quantified from the provided data and should not be assumed.

An attacker holding a low-privilege authenticated account (such as a contributor or author) uses a vulnerable Kadence block to save content containing a malicious script payload. When an administrator or other user later views that content in wp-admin or on the site, the stored script executes in their browser, potentially performing actions as that higher-privileged user. No public exploit code is referenced, and exploitation requires both the authenticated account and the victim viewing the content (AV:N/AC:L/PR:L/UI:R).