CVE-2026-39742: WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability

Q: Who could exploit this issue?

An attacker needs at least low-level privileges in WordPress and must be able to induce a user to interact with the injected content. The attack can be performed remotely over the network.

Q: What is the impact if exploitation succeeds?

Successful exploitation can result in stored JavaScript executing in affected pages. The provided vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

Q: Which plugin versions are affected?

Gutenberg Blocks by Kadence Blocks versions through 3.8.0.2 are affected. The supplied data does not identify a fixed version.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Gutenberg Blocks by Kadence Blocks to a version that resolves this vulnerability.
Fixed in 3.8.1

Event History

Oct 29, 2026

CVE Published

via MITRE·02:20 PM

Data Sourced

via MITRE·02:20 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who could exploit this issue?

An attacker needs at least low-level privileges in WordPress and must be able to induce a user to interact with the injected content. The attack can be performed remotely over the network.

What is the impact if exploitation succeeds?

Successful exploitation can result in stored JavaScript executing in affected pages. The provided vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

Which plugin versions are affected?