CVE-2026-103354
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Gutenberg Blocks by Kadence Blocks plugin up to version 3.7.11.1 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.
Risk Assessment
The organization is at risk of persistent account takeover, content modification, or data theft, which could harm reputation.
Recommendation
It is recommended to update the Gutenberg Blocks by Kadence Blocks plugin to the latest version that eliminates the stored XSS vulnerability.
Other vulnerabilities in Gutenberg Blocks by Kadence Blocks
See all- CVE-2026-115602Medium
The Gutenberg Blocks by Kadence Blocks plugin (up to version 3.8.0.1) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. An attacker can store malicious script that executes in a user's browser.
- CVE-2026-39742Medium
The Gutenberg Blocks by Kadence Blocks plugin (Liquid Web / StellarWP) up to version 3.8.0.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS