# CVE-2026-115602: Kadence Blocks stored cross-site scripting vulnerability

Source: https://junglewise.ai/threats/cve-2026-115602-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115602 · Severity: medium · CVSS 6.5 · Published 2026-10-26

Kadence Blocks is a WordPress plugin that allows content creators to build pages using Gutenberg blocks. A stored cross-site scripting (XSS) vulnerability allows a contributor or higher-privileged user to inject malicious scripts that execute for all site visitors, potentially stealing data or hijacking accounts. The flaw affects versions up to 3.8.0.1 and is patched in 3.8.0.2.

Vendors: [Liquid Web / StellarWP](https://junglewise.ai/threats/vendors/liquid-web-stellarwp).

## Quick answers

**Is CVE-2026-115602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115602 being exploited in the wild.

**How severe is CVE-2026-115602?** Medium severity, with a CVSS score of 6.5, published 26 October 2026.

**Which products and versions are affected?** Liquid Web / StellarWP Kadence Blocks through 3.8.0.1.

**Is there a fix for CVE-2026-115602?** Yes: fixed in 3.8.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115602 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115602?** Check whether you run Liquid Web / StellarWP Kadence Blocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.0.2

## Technical details

This stored XSS vulnerability in Kadence Blocks arises from improper neutralization of user input during page generation in the Gutenberg block editor. The vulnerability requires contributor-level or higher privileges to exploit and user interaction (such as clicking a link or visiting a crafted page). Once injected, malicious scripts persist in the database and execute in the context of all site visitors' browsers.

## Affected products

- Liquid Web / StellarWP Kadence Blocks through 3.8.0.1

## Timeline

- 2026-10-09: disclosed
- 2026-10-26: advisory
- 2026-10-26: patched

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-8-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-8-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Kadence Blocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103354-improper-neutralization-of-input-during-web-page-generation)