CVE-2026-105890: WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Gutenberg Blocks by Kadence Blocksto a version that resolves this vulnerability.Fixed in 3.7.12.1
Event History
Frequently Asked Questions
Which installations should be considered affected?
Installations using Gutenberg Blocks by Kadence Blocks versions through 3.7.12 should be considered affected. The provided data does not identify any unaffected fixed version.
What access would an attacker need to exploit this issue?
An attacker needs network access and low-level privileges in the affected application. Exploitation also requires user interaction.
What is the likely impact if exploitation succeeds?
The issue is a stored cross-site scripting vulnerability with low impacts to confidentiality, integrity, and availability. Its scope is changed, meaning the impact may extend beyond the vulnerable component's original security authority.