Junglewise Threat Intelligence

CVE-2026-18062: StellarWP Kadence Blocks Stored XSS in Identity Block

CVE-2026-18062 · Severity: medium · CVSS 6.4 · Published 2026-08-01

Executive brief

Kadence Blocks is a popular WordPress plugin used to enhance the website building experience. A security flaw in the plugin's Identity Block allows users with contributor-level access or higher to embed malicious scripts into web pages. When other users, including site administrators or visitors, view these pages, the scripts can execute in their browsers, potentially leading to unauthorized actions or data theft.

Technical details

The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the Identity Block's inner image content. This vulnerability is specifically located within the build_html() function of the class-kadence-blocks-identity-block.php file. An attacker with at least contributor-level authentication can exploit this by injecting arbitrary web scripts into a page, provided the block's 'urlTransparent' attribute is set to a non-empty value. When a victim views the affected page, the malicious script executes within the context of their browser session. The issue is addressed in versions following 3.7.8.1.

Affected products

  • StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor up to, and including, 3.7.8.1

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References

Related threats