Kadence Blocks - Page Builder Toolkit for Gutenberg Editor vulnerabilities

Known security issues in the Kadence Blocks - Page Builder Toolkit for Gutenberg Editor WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: kadence-blocks
Latest version: 3.8.0
Active installs: 600,000+
Known vulnerabilities: 43
Data updated: 2026-10-18 09:52 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 3.7.12.1 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.7.12.1
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-105890 · Source	Medium	6.5	< 3.7.12.1	2026-10-08
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute CVE-2026-104762 · Source	Medium	6.4	< 3.7.12.1	2026-10-08

Fixed in version 3.7.12 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.7.12
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-103354 · Source	High	7.1	< 3.7.12	2026-10-04

Fixed in version 3.7.8.2 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.7.8.2
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content CVE-2026-18062 · Source	Medium	6.4	< 3.7.8.2	2026-07-31

Fixed in version 3.7.8.1 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.7.8.1
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute CVE-2026-18435 · Source	Medium	6.4	< 3.7.8.1	2026-07-31
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure CVE-2026-66696 · Source	Medium	4.3	< 3.7.8.1	2026-07-29

Fixed in version 3.7.8 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.7.8
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions CVE-2026-12902 · Source	Medium	4.3	< 3.7.8	2026-06-30
Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter CVE-2026-12904 · Source	Medium	4.3	< 3.7.8	2026-06-30

Fixed in version 3.7.6 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.7.6
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization CVE-2026-11357 · Source	Medium	4.3	< 3.7.6	2026-06-17

Fixed in version 3.6.4 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.6.4
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload CVE-2026-2826 · Source	Not rated	-	< 3.6.4	0000-00-00

Fixed in version 3.6.2 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.6.2
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload CVE-2026-2633 · Source	Not rated	-	< 3.6.2	0000-00-00
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter CVE-2026-1857 · Source	Not rated	-	< 3.6.2	0000-00-00

Fixed in version 3.6.0 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.6.0
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication CVE-2026-15286 · Source	Medium	4.3	< 3.6.0	2026-02-10
Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization CVE-2026-2608 · Source	Not rated	-	< 3.6.0	0000-00-00

Fixed in version 3.5.11 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.5.11
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter CVE-2025-5678 · Source	Medium	5.4	< 3.5.11	0000-00-00

Fixed in version 3.4.10 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.4.10
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' CVE-2025-1291 · Source	Medium	6.4	< 3.4.10	0000-00-00

Fixed in version 3.4.3 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.4.3
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link CVE-2024-12304 · Source	Medium	6.4	< 3.4.3	2025-01-10

Fixed in version 3.3.4 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.3.4
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-10785 · Source	Medium	6.4	< 3.3.4	2024-11-20

Fixed in version 3.3.2 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.3.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2024-9655 · Source	Medium	5.4	< 3.3.2	2024-10-31
Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Missing Authorization CVE-2025-24753 · Source	Medium	4.3	< 3.3.2	2025-01-24

Fixed in version 3.2.54 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.54
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Gutenberg Blocks by Kadence Blocks Plugin < 3.2.54 is vulnerable to Cross Site Scripting (XSS) CVE-2024-10637 · Source	Medium	5.4	< 3.2.54	2024-11-21
Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-12581 · Source	Medium	4.4	< 3.2.54	2024-11-21

Fixed in version 3.2.46 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.46
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes CVE-2024-5819 · Source	Medium	5.4	< 3.2.46	2024-06-28

Fixed in version 3.2.43 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.43
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget CVE-2024-5289 · Source	Medium	5.4	< 3.2.43	2024-06-26

Fixed in version 3.2.39 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.39
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Gutenberg Blocks by Kadence Blocks Plugin < 3.2.39 is vulnerable to Cross Site Scripting (XSS) CVE-2024-6884 · Source	Medium	5.4	< 3.2.39	2024-07-18
WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.38 is vulnerable to Cross Site Scripting (XSS) CVE-2024-4863 · Source	Medium	5.4	< 3.2.39	2024-06-13

Fixed in version 3.2.38 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.38
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-3189 · Source	Medium	5.4	< 3.2.38	2024-05-14
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect CVE-2024-4208 · Source	Medium	5.4	< 3.2.38	2024-05-14

Fixed in version 3.2.37 (3)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.37
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4057 · Source	Medium	6.1	< 3.2.37	2024-05-14
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer CVE-2024-4209 · Source	Medium	5.4	< 3.2.37	2024-05-10
Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link CVE-2024-4481 · Source	Medium	5.4	< 3.2.37	2024-05-09

Fixed in version 3.2.35 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.35
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2273 · Source	Medium	5.4	< 3.2.35	2024-05-01

Fixed in version 3.2.32 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.32
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget CVE-2024-2919 · Source	Medium	5.4	< 3.2.32	2024-04-03

Fixed in version 3.2.26 (4)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.26
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Gutenberg Blocks by Kadence Blocks Plugin < 3.2.26 is vulnerable to Cross Site Scripting (XSS) CVE-2024-2509 · Source	Medium	6.5	< 3.2.26	2024-04-05
WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.25 is vulnerable to Server Side Request Forgery (SSRF) CVE-2024-24888 · Source	Medium	6.4	< 3.2.26	2024-03-29
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget CVE-2024-1999 · Source	Medium	5.4	< 3.2.26	2024-03-21
Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2866 · Source	Low	0.0	< 3.2.26	2024-03-15

Fixed in version 3.2.24 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.24
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1541 · Source	Medium	5.4	< 3.2.24	2024-03-01

Fixed in version 3.2.20 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.20
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.19 is vulnerable to Server Side Request Forgery (SSRF) CVE-2024-23500 · Source	High	7.7	< 3.2.20	2024-03-26

Fixed in version 3.2.18 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.18
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings CVE-2024-0598 · Source	Medium	4.8	< 3.2.18	2024-04-02

Fixed in version 3.2.12 (1)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.2.12
Vulnerability	Severity	CVSS	Affected versions	Published
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) CVE-2023-6964 · Source	Medium	6.4	< 3.2.12	2024-04-09

Fixed in version 3.1.11 (2)

Kadence Blocks - Page Builder Toolkit for Gutenberg Editor: Fixed in version 3.1.11
Vulnerability	Severity	CVSS	Affected versions	Published
Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 3.1.11	2023-08-09
WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.1.10 is vulnerable to Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 3.1.11	2023-08-09

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.