Live › vulnerability › CVE-2026-115602
Go to dashboardGutenberg Blocks by Kadence Blocks, a WordPress plugin from Liquid Web and StellarWP, fails to neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can place content on a page can run scripts in the browser of visitors or administrators who view it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running the Gutenberg Blocks by Kadence Blocks plugin at version 3.8.0.1 or earlier are affected. Exposure depends on who can add or edit content that is rendered to other users; sites where only trusted editors write content carry less risk. The sources do not say which roles or settings make the stored payload reachable.
No product ranges from the sources yet.
kadence-blocks plugin in the WordPress admin under Plugins, or with wp plugin get kadence-blocks --field=version3.8.0.1 or earlierkadence-blocks plugin to a version later than 3.8.0.1 (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.