EN ES
Start free
Menu

Kadence Blocks: known security problems

42 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 42 known security problems on this page. Each one has a fixed version. Updating to version 3.8.0.2 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.8.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.0.1
Fixed in
3.8.0.2
What to do
If your site has an affected version, update Kadence Blocks to version 3.8.0.2 or newer.
Official ID
CVE-2026-115602
Report title
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.12
Fixed in
3.7.12.1
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.12.1 or newer.
Official ID
CVE-2026-104762
Report title
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.7.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.12
Fixed in
3.7.12.1
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.12.1 or newer.
Official ID
CVE-2026-105890
Report title
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.11.1
Fixed in
3.7.12
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.12 or newer.
Official ID
CVE-2026-103354
Report title
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.7.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.8.1
Fixed in
3.7.8.2
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.8.2 or newer.
Official ID
CVE-2026-18062
Report title
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.7.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.8
Fixed in
3.7.8.1
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.8.1 or newer.
Official ID
CVE-2026-18435
Report title
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.7.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.8
Fixed in
3.7.8.1
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.8.1 or newer.
Official ID
CVE-2026-66696
Report title
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.7.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.7
Fixed in
3.7.8
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.8 or newer.
Official ID
CVE-2026-12904
Report title
Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter
First reported
Sources
This week

Someone with a contributor account on your site could do things on your site they should not be allowed to (up to and including 3.7.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.7
Fixed in
3.7.8
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.8 or newer.
Official ID
CVE-2026-12902
Report title
Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.5
Fixed in
3.7.6
What to do
If your site has an affected version, update Kadence Blocks to version 3.7.6 or newer.
Official ID
CVE-2026-11357
Report title
Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
First reported
Sources
This week

Someone with a contributor account on your site could do things on your site they should not be allowed to (up to and including 3.6.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.3
Fixed in
3.6.4
What to do
If your site has an affected version, update Kadence Blocks to version 3.6.4 or newer.
Official ID
CVE-2026-2826
Report title
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
First reported
Sources
This week

Someone with a contributor account on your site could do things on your site they should not be allowed to (up to and including 3.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.1
Fixed in
3.6.2
What to do
If your site has an affected version, update Kadence Blocks to version 3.6.2 or newer.
Official ID
CVE-2026-2633
Report title
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
First reported
Sources
This week

Someone with a contributor account on your site could make your server visit other addresses on their behalf (up to and including 3.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.1
Fixed in
3.6.2
What to do
If your site has an affected version, update Kadence Blocks to version 3.6.2 or newer.
Official ID
CVE-2026-1857
Report title
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.5.32)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.32
Fixed in
3.6.0
What to do
If your site has an affected version, update Kadence Blocks to version 3.6.0 or newer.
Official ID
CVE-2026-2608
Report title
Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.5.32)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.32
Fixed in
3.6.0
What to do
If your site has an affected version, update Kadence Blocks to version 3.6.0 or newer.
Official ID
CVE-2026-15286
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.5.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.10
Fixed in
3.5.11
What to do
If your site has an affected version, update Kadence Blocks to version 3.5.11 or newer.
Official ID
CVE-2025-5678
Report title
Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.9
Fixed in
3.4.10
What to do
If your site has an affected version, update Kadence Blocks to version 3.4.10 or newer.
Official ID
CVE-2025-1291
Report title
Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.1
Fixed in
3.3.2
What to do
If your site has an affected version, update Kadence Blocks to version 3.3.2 or newer.
Official ID
CVE-2025-24753
Report title
Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.2
Fixed in
3.4.3
What to do
If your site has an affected version, update Kadence Blocks to version 3.4.3 or newer.
Official ID
CVE-2024-12304
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.53
Fixed in
3.2.54
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.54 or newer.
Official ID
CVE-2024-12581
Report title
Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.53)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.53
Fixed in
3.2.54
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.54 or newer.
Official ID
CVE-2024-10637
Report title
Kadence Blocks <= 3.2.53 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.3
Fixed in
3.3.4
What to do
If your site has an affected version, update Kadence Blocks to version 3.3.4 or newer.
Official ID
CVE-2024-10785
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.1
Fixed in
3.3.2
What to do
If your site has an affected version, update Kadence Blocks to version 3.3.2 or newer.
Official ID
CVE-2024-9655
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.28
Fixed in
3.2.39
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.39 or newer.
Official ID
CVE-2024-6884
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.45)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.45
Fixed in
3.2.46
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.46 or newer.
Official ID
CVE-2024-5819
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.42
Fixed in
3.2.43
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.43 or newer.
Official ID
CVE-2024-5289
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.38)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.38
Fixed in
3.2.39
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.39 or newer.
Official ID
CVE-2024-4863
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.37)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.37
Fixed in
3.2.38
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.38 or newer.
Official ID
CVE-2024-3189
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.37) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.37
Fixed in
3.2.38
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.38 or newer.
Official ID
CVE-2024-4208
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.36)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.36
Fixed in
3.2.37
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.37 or newer.
Official ID
CVE-2024-4057
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.36) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.36
Fixed in
3.2.37
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.37 or newer.
Official ID
CVE-2024-4209
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.36) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.36
Fixed in
3.2.37
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.37 or newer.
Official ID
CVE-2024-4481
Report title
Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.34
Fixed in
3.2.35
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.35 or newer.
Official ID
CVE-2024-2273
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could make your server visit other addresses on their behalf (up to and including 3.1.26)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.1.26
Fixed in
3.2.12
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.12 or newer.
Official ID
CVE-2023-6964
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.31)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.31
Fixed in
3.2.32
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.32 or newer.
Official ID
CVE-2024-2919
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget
First reported
Sources
This week

Someone with an editor account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.17
Fixed in
3.2.18
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.18 or newer.
Official ID
CVE-2024-0598
Report title
Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings
First reported
Sources
This week

Someone with an author account on your site could make your server visit other addresses on their behalf

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.25
Fixed in
3.2.26
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.26 or newer.
Official ID
CVE-2024-24888
Report title
Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery
First reported
Sources
This week

Someone with a contributor account on your site could make your server visit other addresses on their behalf (up to and including 3.2.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.19
Fixed in
3.2.20
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.20 or newer.
Official ID
CVE-2024-23500
Report title
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.19 - Authenticated (Contributor+) Server-Side Request Forgery
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.25)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.25
Fixed in
3.2.26
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.26 or newer.
Official ID
CVE-2024-1999
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.25) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.25
Fixed in
3.2.26
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.26 or newer.
Official ID
CVE-2024-2509
Report title
Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.23
Fixed in
3.2.24
What to do
If your site has an affected version, update Kadence Blocks to version 3.2.24 or newer.
Official ID
CVE-2024-1541
Report title
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.11
Fixed in
3.1.11
What to do
If your site has an affected version, update Kadence Blocks to version 3.1.11 or newer.
Report title
Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)