Kadence Blocks EUVD-2026-51749

Exploitation requires an active WordPress account with at minimum the contributor role; the CVSS PR:L metric confirms unauthenticated exploitation is not possible. The Identity Block's urlTransparent attribute must be set to a non-empty value - this is not a default state and must be deliberately configured; because contributors control their own block attributes in the Gutenberg editor, the attacker themselves can set this condition without needing a pre-existing site configuration. The vulnerable rendering logic is confined to the Identity Block's inner image content in class-kadence-blocks-identity-block.php; other blocks in the plugin are not implicated by this advisory. Limiting factors that reduce realistic exposure: sites that do not permit open contributor registration or limit contributor accounts to vetted internal users significantly raise the bar for exploitation; sites where the Identity Block is absent from the allowed block list cannot reach the vulnerable code path at all; and sites running versions beyond 3.7.8.1 with the patch applied are not affected.

The CVSS 6.4 score captures a network-accessible, low-complexity stored XSS with cross-session scope change, which is a meaningful real-world threat on multi-author WordPress deployments. Two factors substantially limit realistic risk beyond the raw score: authentication is required at contributor level (PR:L), eliminating unauthenticated mass exploitation; and the urlTransparent attribute must be explicitly set to a non-empty value by the attacker, meaning the vulnerable code path is not triggered on all Identity Block usages - only on deliberately configured instances. No EPSS data was supplied with this intelligence, preventing quantified exploitation probability assessment. This vulnerability is absent from CISA KEV and no POC exploit code has been identified, indicating no confirmed or widespread active exploitation at time of analysis. The practical threat is highest on sites permitting open contributor registration or operating with multiple content editors, where a malicious or compromised contributor could target administrator sessions. For single-author WordPress sites or environments with tightly controlled contributor onboarding, actual risk is materially lower than the CVSS score alone suggests. No conflicting signals between data sources were observed; the CVSS vector is consistent with the described exploitation conditions.

An attacker obtains or registers a contributor-level WordPress account on the target site, navigates to the Gutenberg editor, inserts a Kadence Identity Block into a post or page, sets the urlTransparent attribute to any non-empty string to activate the vulnerable code path, and embeds a JavaScript payload in the inner image content field before publishing. When an administrator or any site visitor subsequently loads that page, the attacker's script executes silently in their browser, enabling session token exfiltration, credential harvesting via injected login overlays, or forced authenticated actions under the victim's identity. No public exploit code has been identified at time of analysis.