Gutenberg Blocks By Kadence Blocks
Monthly
Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.
Stored cross-site scripting in the Kadence Blocks WordPress plugin through 3.8.0.2 allows an authenticated low-privileged user to persist malicious input that executes when an administrator or site visitor views the affected content. Patchstack rates the issue CVSS 6.5 and this_month priority; the assessed vector requires PR:L and UI:R, so exploitation depends on a pre-existing posting-capable account and victim interaction. No public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Gutenberg Blocks by Kadence Blocks (versions through 3.8.0.1) lets a low-privileged authenticated user persist script-bearing content that executes in another user's browser when that content is rendered. Per the assessed vector (CVSS 6.5, AV:L/AC:L/PR:L/UI:R/S:C), an attacker must already hold a content-contributing account such as contributor or author, and impact only materializes when a separate victim - typically a higher-privileged user viewing the affected page - loads the injected content. The issue was reported by Patchstack and is scheduled for this-month remediation priority; no public exploit code or active exploitation (CISA KEV) is associated with it at time of analysis, though successful exploitation crosses a privilege boundary (scope change) and can yield limited confidentiality, integrity and availability effects.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.
Stored cross-site scripting in the Kadence Blocks WordPress plugin through 3.8.0.2 allows an authenticated low-privileged user to persist malicious input that executes when an administrator or site visitor views the affected content. Patchstack rates the issue CVSS 6.5 and this_month priority; the assessed vector requires PR:L and UI:R, so exploitation depends on a pre-existing posting-capable account and victim interaction. No public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Gutenberg Blocks by Kadence Blocks (versions through 3.8.0.1) lets a low-privileged authenticated user persist script-bearing content that executes in another user's browser when that content is rendered. Per the assessed vector (CVSS 6.5, AV:L/AC:L/PR:L/UI:R/S:C), an attacker must already hold a content-contributing account such as contributor or author, and impact only materializes when a separate victim - typically a higher-privileged user viewing the affected page - loads the injected content. The issue was reported by Patchstack and is scheduled for this-month remediation priority; no public exploit code or active exploitation (CISA KEV) is associated with it at time of analysis, though successful exploitation crosses a privilege boundary (scope change) and can yield limited confidentiality, integrity and availability effects.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.