CVE-2026-39742
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Gutenberg Blocks by Kadence Blocks plugin (Liquid Web / StellarWP) up to version 3.8.0.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
Risk Assessment
An attacker may inject a malicious script that executes in the browsers of users visiting the site, potentially leading to session or data theft.
Recommendation
Update Kadence Blocks to a version newer than 3.8.0.2 as soon as it is available.
Other vulnerabilities in Gutenberg Blocks by Kadence Blocks
See all- CVE-2026-115602Medium
The Gutenberg Blocks by Kadence Blocks plugin (up to version 3.8.0.1) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. An attacker can store malicious script that executes in a user's browser.
- CVE-2026-103354High
The Gutenberg Blocks by Kadence Blocks plugin up to version 3.7.11.1 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS