{"id":"CVE-2026-115602","kind":"vulnerability","aliases":["CVE-2026-115602"],"related":[],"title":"Kadence Blocks WordPress plugin: stored XSS through version 3.8.0.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.","summary":"Gutenberg Blocks by Kadence Blocks, a WordPress plugin from Liquid Web and StellarWP, fails to neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can place content on a page can run scripts in the browser of visitors or administrators who view it.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kadence-blocks","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the `kadence-blocks` plugin in the WordPress admin under Plugins, or with `wp plugin get kadence-blocks --field=version`\n- Confirm whether the version is `3.8.0.1` or earlier","fix":"- Update the `kadence-blocks` plugin to a version later than `3.8.0.1` (the fixed version is unknown from the sources)","status":"open","published_at":"2026-10-26T10:16:51+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:50+00:00","updated_at":"2026-10-26T10:30:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T10:30:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the `kadence-blocks` plugin to a version later than `3.8.0.1` (the fixed version is unknown from the sources)","reach":"internet","title":"Kadence Blocks WordPress plugin: stored XSS through version 3.8.0.1","impact":"medium","summary":"Gutenberg Blocks by Kadence Blocks, a WordPress plugin from Liquid Web and StellarWP, fails to neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can place content on a page can run scripts in the browser of visitors or administrators who view it.","category":"package","nicknames":[],"who_cares":["wordpress","kadence-blocks","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' and admins' browsers","analyst_note":"Confirm the fixed version and the privilege level needed to inject the stored payload from the NVD entry or the Wordfence/vendor advisory.","how_to_check":"- Check the installed version of the `kadence-blocks` plugin in the WordPress admin under Plugins, or with `wp plugin get kadence-blocks --field=version`\n- Confirm whether the version is `3.8.0.1` or earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Gutenberg Blocks by Kadence Blocks plugin at version 3.8.0.1 or earlier are affected. Exposure depends on who can add or edit content that is rendered to other users; sites where only trusted editors write content carry less risk. The sources do not say which roles or settings make the stored payload reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3348,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115602':12A,15A '-2026':11A,14A '3.8.0.1':9A,109C 'administr':68B 'affect':100C 'allow':96C 'attack':51B 'block':2A,18B,25B,28B,89C,92C,95C,102C,105C 'browser':64B 'content':55B 'cross':47B,80C 'cross-sit':46B,79C 'cve':10A,13A 'enabl':44B 'fail':37B 'generat':42B,78C 'gutenberg':24B,88C,101C 'host':22B 'improp':71C 'input':40B,74C 'issu':99C 'kadenc':1A,17B,27B,91C,94C,104C 'kadence-block':16B,93C 'liquid':33B,85C 'n/a':107C 'neutral':39B,72C 'packag':19B 'page':43B,58B,77C 'place':54B 'plugin':4A,31B 'run':60B 'script':49B,61B,82C 'self':21B 'self-host':20B 'site':48B,81C 'stellarwp':36B,87C 'store':5A,45B,97C 'version':8A 'view':70B 'visitor':66B 'vulner':83C 'web':34B,76C,86C 'wordpress':3A,23B,30B 'xss':6A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gutenberg Blocks by Kadence Blocks plugin at version 3.8.0.1 or earlier are affected. Exposure depends on who can add or edit content that is rendered to other users; sites where only trusted editors write content carry less risk. The sources do not say which roles or settings make the stored payload reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115602","severity":null,"published_at":"2026-10-26T10:16:51+00:00","modified_at":"2026-10-26T10:16:51+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}