What’s Vulnerable › Products

stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor vulnerabilities

37 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor version is affected

Latest stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor vulnerabilities

• CVE-2026-104762 — Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute (CVSS 6.4)
• CVE-2026-18435 — Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute (CVSS 6.4)
• CVE-2026-18062 — Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content (CVSS 6.4)
• CVE-2026-15286 — Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication (CVSS 4.3)
• CVE-2026-12904 — Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter (CVSS 4.3)
• CVE-2026-12902 — Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions (CVSS 4.3)
• CVE-2026-11357 — Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization (CVSS 4.3)
• CVE-2026-2826 — Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload (CVSS 4.3)
• CVE-2026-2633 — Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload (CVSS 4.3)
• CVE-2026-1857 — Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter (CVSS 4.3)
• CVE-2026-2608 — Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization (CVSS 4.3)
• CVE-2025-5678 — Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter (CVSS 5.4)
• CVE-2025-1291 — Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' (CVSS 6.4)
• CVE-2025-24753 — WordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-12304 — Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link (CVSS 5.4)
• CVE-2024-12581 — Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2024-10637 — Kadence Blocks < 3.2.54 - Admin+ Stored XSS (CVSS 5.4)
• CVE-2024-10785 — Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-9655 — Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget (CVSS 5.4)
• CVE-2024-6884 — Gutenberg Blocks with AI by Kadence WP < 3.2.39 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2024-5819 — Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes (CVSS 5.4)
• CVE-2024-5289 — Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget (CVSS 5.4)
• CVE-2024-4863 — Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter (CVSS 5.4)
• CVE-2024-4057 — Gutenberg Blocks by Kadence Blocks < 3.2.37 - Contributor+ Stored XSS (CVSS 6.1)
• CVE-2024-4208 — Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect (CVSS 5.4)