Advisories · Technology
stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor.
Every CVE that names stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Broken access control
- CVSS 4.3 Medium
Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Broken access control
- CVSS 4.3 Medium
Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Broken access control
- CVSS 4.3 Medium
Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Information disclosure
- CVSS 4.3 Medium
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Broken access control
- CVSS 4.3 Medium
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Broken access control
- CVSS 4.3 Medium
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Broken access control
- CVSS 6.4 Medium
Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 8.5 High
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)