Live › vulnerability › CVE-2026-39742
Gutenberg Blocks by Kadence Blocks, a WordPress plugin from Liquid Web and StellarWP, fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can get script saved into a page can run it in the browsers of visitors or editors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the Gutenberg Blocks by Kadence Blocks plugin at version 3.8.0.2 or earlier are affected. Exploitation needs a way to store script in page content, so sites where only trusted editors can write content carry less risk. Sites not running the plugin can skip it.
No product ranges from the sources yet.
wp plugin get kadence-blocks --field=version3.8.0.2; the source does not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-39742")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.