Kadence Blocks Page Builder Toolkit For Gutenberg Editor
Monthly
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.
Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributors to create arbitrary Media Library attachments by fetching remote images via internal WordPress functions, bypassing the upload_files capability boundary. The flaw resides in class-kadence-blocks-prebuilt-library.php at multiple call sites where wp_upload_bits() and wp_insert_attachment() are invoked without verifying the requesting user's authorization. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kadence Blocks WordPress plugin versions up to and including 3.7.7 allows authenticated Contributor-level users to read or delete optimizer analysis records belonging to posts they do not own, by exploiting a parameter mismatch in four REST API endpoints of the Optimize_Rest_Controller. The authorization check binds to a user-supplied post_id while the storage layer retrieves records by sha256 of a separately supplied, attacker-controlled post_path, with no enforcement that these two parameters refer to the same post. No public exploit code or CISA KEV listing exists at time of analysis; however, the low barrier to exploitation - any registered Contributor can leverage this - makes it relevant for multi-author WordPress sites. EPSS data was not provided in the input.
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authenticated contributors to read the site's Kadence license key, license owner email, api_key, api_email, and license domain directly from the browser console via the JavaScript global window.kadence_blocks_params.proData. The credentials are serialized client-side through the editor_assets_variables mechanism and require no server-side manipulation to extract. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypass authorization checks and upload arbitrary images to the Media Library via the process_pattern REST API endpoint. An attacker with contributor-level access or higher can supply remote image URLs that the server downloads and converts into media attachments, exploiting missing capability verification for the upload_files action. No public exploit code or active exploitation has been reported at time of analysis.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.
Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributors to create arbitrary Media Library attachments by fetching remote images via internal WordPress functions, bypassing the upload_files capability boundary. The flaw resides in class-kadence-blocks-prebuilt-library.php at multiple call sites where wp_upload_bits() and wp_insert_attachment() are invoked without verifying the requesting user's authorization. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kadence Blocks WordPress plugin versions up to and including 3.7.7 allows authenticated Contributor-level users to read or delete optimizer analysis records belonging to posts they do not own, by exploiting a parameter mismatch in four REST API endpoints of the Optimize_Rest_Controller. The authorization check binds to a user-supplied post_id while the storage layer retrieves records by sha256 of a separately supplied, attacker-controlled post_path, with no enforcement that these two parameters refer to the same post. No public exploit code or CISA KEV listing exists at time of analysis; however, the low barrier to exploitation - any registered Contributor can leverage this - makes it relevant for multi-author WordPress sites. EPSS data was not provided in the input.
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authenticated contributors to read the site's Kadence license key, license owner email, api_key, api_email, and license domain directly from the browser console via the JavaScript global window.kadence_blocks_params.proData. The credentials are serialized client-side through the editor_assets_variables mechanism and require no server-side manipulation to extract. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypass authorization checks and upload arbitrary images to the Media Library via the process_pattern REST API endpoint. An attacker with contributor-level access or higher can supply remote image URLs that the server downloads and converts into media attachments, exploiting missing capability verification for the upload_files action. No public exploit code or active exploitation has been reported at time of analysis.