CVE-2026-104762: Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This encoding bypass is only triggered when the "Load Google Fonts Locally" site option (kadenceblocksfontsettings['loadfontslocal']) is enabled, which is not the default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the “Load Google Fonts Locally” site option to prevent this vulnerability from being triggered.
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence_blocks_font_settings['load_fonts_local'] = false
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Kadence Blocks version 3.7.12 or earlier are affected only when the “Load Google Fonts Locally” option is enabled. That option is not enabled by default.
What access does an attacker need?
An attacker must be authenticated to WordPress with an Author-level account or higher. They can inject script through a block’s font family attribute into a page they can modify.
What happens after malicious content is saved?
The injected script executes whenever a user visits the affected page. The vulnerability can affect confidentiality and integrity in the visitor’s browser context.
What can be done if updating is not immediately possible?
Disable the “Load Google Fonts Locally” site option to prevent the condition that triggers this encoding bypass. Review pages editable by Author-level and higher users for untrusted font family values.