# CVE-2026-11357: StellarWP Kadence Blocks sensitive information exposure in editor_assets_variables

Source: https://junglewise.ai/threats/cve-2026-11357-stellarwp-kadence-blocks-sensitive-information-exposure-in-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-11357 · Severity: medium · CVSS 4.3 · Published 2026-06-18

A vulnerability in the Kadence Blocks WordPress plugin allows users with low-level 'Contributor' access to view sensitive account information. This includes the site owner's license keys and API credentials for the Kadence service. An attacker could use this information to potentially hijack the license or access associated account services, though it does not directly grant control over the website itself.

Technologies: [StellarWP Kadence Blocks](https://junglewise.ai/threats/technologies/kadence-blocks). Vendors: [StellarWP](https://junglewise.ai/threats/vendors/stellarwp).

## Quick answers

**Is CVE-2026-11357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11357 being exploited in the wild.

**How severe is CVE-2026-11357?** Medium severity, with a CVSS score of 4.3, published 18 June 2026.

**Which products and versions are affected?** StellarWP Kadence Blocks up to, and including, 3.7.5.

**Is there a fix for CVE-2026-11357?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11357 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11357?** Check whether you run StellarWP Kadence Blocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kadence Blocks plugin for WordPress (versions <= 3.7.5) suffers from a sensitive information exposure vulnerability (CWE-200) within the 'editor_assets_variables' component. The plugin improperly exposes the 'proData' object, containing the Kadence account license key, owner email, API key, and license domain, to the client-side environment. This data is accessible via the 'window.kadence_blocks_params.proData' JavaScript object in the browser console. An authenticated attacker with Contributor-level permissions or higher can retrieve these credentials without any server-side request manipulation, provided an administrator has previously activated a valid license. A patch is available in versions following 3.7.5.

## Affected products

- StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor up to, and including, 3.7.5

## Timeline

- 2026-06-18: disclosed
- 2026-06-18: advisory

## References

- [https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.7/includes/class-kadence-blocks-editor-assets.php](https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.7/includes/class-kadence-blocks-editor-assets.php)
- [https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.7/includes/class-kadence-blocks-editor-assets.php](https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.7/includes/class-kadence-blocks-editor-assets.php)
- [https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.7/includes/helper-functions.php](https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.7/includes/helper-functions.php)
- [https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.5/includes/class-kadence-blocks-editor-assets.php](https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.5/includes/class-kadence-blocks-editor-assets.php)
- [https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.5/includes/class-kadence-blocks-editor-assets.php](https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.5/includes/class-kadence-blocks-editor-assets.php)
- [https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.5/includes/helper-functions.php](https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.5/includes/helper-functions.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3569191%40kadence-blocks&new=3569191%40kadence-blocks&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3569191%40kadence-blocks&new=3569191%40kadence-blocks&sfp_email=&sfph_mail=)