CVE-2026-115602
MediumCVSS 6.5Summary
The Gutenberg Blocks by Kadence Blocks plugin (up to version 3.8.0.1) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. An attacker can store malicious script that executes in a user's browser.
Risk Assessment
It is possible to execute arbitrary JavaScript in a victim's browser, potentially leading to session data theft or account takeover. The risk affects websites running the vulnerable plugin version.
Recommendation
Update the Gutenberg Blocks by Kadence Blocks plugin to the latest version (above 3.8.0.1). Regular review of content for unauthorized changes is also recommended.
Other vulnerabilities in Gutenberg Blocks by Kadence Blocks
See all- CVE-2026-39742Medium
The Gutenberg Blocks by Kadence Blocks plugin (Liquid Web / StellarWP) up to version 3.8.0.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
- CVE-2026-103354High
The Gutenberg Blocks by Kadence Blocks plugin up to version 3.7.11.1 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS