CVE-2026-115602: WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Gutenberg Blocks by Kadence Blocksto a version that resolves this vulnerability.Fixed in 3.8.0.2
Event History
Frequently Asked Questions
Which installations are affected?
StellarWP Gutenberg Blocks by Kadence Blocks installations are affected through version 3.8.0.1. No fixed version is identified in the provided data.
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation is possible over the network with low privileges and low attack complexity. It also requires user interaction.
What is the likely security impact?
The issue is rated medium severity with a CVSS score of 6.5. The vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.