Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

Vulnerabilities

• CVE-2025-24753login required≤ 3.3.1

  WordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerability

  High 8.8

• CVE-2024-24888login required≤ 3.2.25

  WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability

  Medium 6.5

• CVE-2024-23500login required≤ 3.2.19

  WordPress Kadence Blocks plugin <= 3.2.19 - Server Side Request Forgery (SSRF) vulnerability

  Medium 6.5

• CVE-2026-18435contributor+≤ 3.7.8

  Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute

  Medium 6.4

• CVE-2026-18062contributor+≤ 3.7.8.1

  Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

  Medium 6.4

• CVE-2025-1291contributor+≤ 3.4.9

  Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'

  Medium 6.4

• CVE-2023-6964contributor+≤ 3.1.26

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)

  Medium 6.4

• CVE-2025-5678contributor+≤ 3.5.10

  Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter

  Medium 5.4

• CVE-2024-12304contributor+≤ 3.4.2

  Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link

  Medium 5.4

• CVE-2024-10785contributor+≤ 3.3.3

  Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-9655contributor+≤ 3.3.1

  Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget

  Medium 5.4

• CVE-2024-5819contributor+≤ 3.2.45

  Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attr

  Medium 5.4

• CVE-2024-5289contributor+≤ 3.2.42

  Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget

  Medium 5.4

• CVE-2024-4863contributor+≤ 3.2.38

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter

  Medium 5.4

• CVE-2024-4208contributor+≤ 3.2.37

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect

  Medium 5.4

• CVE-2024-3189contributor+≤ 3.2.37

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-4481contributor+≤ 3.2.36

  Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link

  Medium 5.4

• CVE-2024-4209contributor+≤ 3.2.36

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer

  Medium 5.4

• CVE-2024-2273contributor+≤ 3.2.34

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-1999contributor+≤ 3.2.25

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget

  Medium 5.4

• CVE-2024-2919contributor+≤ 3.2.31

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget

  Medium 5.4

• CVE-2024-1541contributor+≤ 3.2.23

  Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-0598editor+≤ 3.2.17

  Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings

  Medium 4.8

• CVE-2026-66696contributor+≤ 3.7.8

  WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

  Medium 4.3

• CVE-2026-15286contributor+≤ 3.5.32

  Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication

  Medium 4.3

• CVE-2026-12904contributor+≤ 3.7.7

  Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' P

  Medium 4.3

• CVE-2026-12902contributor+≤ 3.7.7

  Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_i

  Medium 4.3

• CVE-2026-11357contributor+≤ 3.7.5

  Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

  Medium 4.3

• CVE-2026-2826contributor+≤ 3.6.3

  Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload

  Medium 4.3

• CVE-2026-2633contributor+≤ 3.6.1

  Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload

  Medium 4.3

• CVE-2026-1857contributor+≤ 3.6.1

  Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter

  Medium 4.3

• CVE-2026-2608contributor+≤ 3.5.32

  Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization

  Medium 4.3