Plugin security history

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 37 vulnerability records associated with Kadence Blocks — Page Builder Toolkit for Gutenberg Editor, published between 2023 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

37Total records

1Critical

1High

35Medium

0Low

0Informational

37Patched records

0Currently marked unpatched

2023-08-09First disclosure

2026-07-31Latest disclosure

36 of 37CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	1	1 records
2024	22	22 records
2025	4	4 records
2026	10	10 records

Severity Breakdown

Severity	Records	Share
Critical	1	2.7%
High	1	2.7%
Medium	35	94.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

24 records64.9%

First: 2024. Latest: 2026.

Missing Authorization

7 records18.9%

First: 2025. Latest: 2026.

Other

4 records10.8%

First: 2024. Latest: 2026.

Arbitrary File Upload

1 record2.7%

First: 2023. Latest: 2023.

Information Disclosure

1 record2.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 37
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.7.8.2
3.7.8.1
3.7.8
3.7.6
3.6.4
3.6.2
3.6.0
3.5.11
3.4.10
3.3.2
3.4.3
3.2.54
3.3.4
3.2.39
3.2.46
3.2.43
3.2.38
3.2.37
3.2.35
3.2.12
3.2.32
3.2.18
3.2.26
3.2.20
3.2.24
3.1.11

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.7.8.1`	Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content	July 31, 2026	3.7.8.2	Medium
`*-3.7.8`	Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute	July 31, 2026	3.7.8.1	Medium
`*-3.7.7`	Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter	June 30, 2026	3.7.8	Medium
`*-3.7.7`	Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions	June 30, 2026	3.7.8	Medium
`*-3.7.5`	Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization	June 17, 2026	3.7.6	Medium
`*-3.6.3`	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload	April 3, 2026	3.6.4	Medium
`*-3.6.1`	Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload	February 17, 2026	3.6.2	Medium
`*-3.6.1`	Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter	February 17, 2026	3.6.2	Medium
`*-3.5.32`	Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization	February 11, 2026	3.6.0	Medium
`*-3.5.32`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication	February 10, 2026	3.6.0	Medium
`*-3.5.10`	Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter	July 8, 2025	3.5.11	Medium
`*-3.4.9`	Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'	February 28, 2025	3.4.10	Medium
`*-3.3.1`	Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Missing Authorization	January 24, 2025	3.3.2	Medium
`*-3.4.2`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link	January 10, 2025	3.4.3	Medium
`*-3.2.53`	Kadence Blocks <= 3.2.53 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 21, 2024	3.2.54	Medium
`*-3.2.53`	Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting	November 21, 2024	3.2.54	Medium
`*-3.3.3`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 20, 2024	3.3.4	Medium
`*-3.3.1`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget	October 31, 2024	3.3.2	Medium
`*-3.2.28`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown	July 18, 2024	3.2.39	Medium
`*-3.2.45`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes	June 28, 2024	3.2.46	Medium
`*-3.2.42`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget	June 26, 2024	3.2.43	Medium
`*-3.2.38`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter	June 13, 2024	3.2.39	Medium
`*-3.2.36`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 14, 2024	3.2.37	Medium
`*-3.2.37`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect	May 14, 2024	3.2.38	Medium
`*-3.2.37`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 14, 2024	3.2.38	Medium

Selected source records

Latest Records

MediumCVE-2026-18062

Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

Published: July 31, 2026

Affected versions: *-3.7.8.1
Patched versions: 3.7.8.2

Original Wordfence record

MediumCVE-2026-18435

Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute

Published: July 31, 2026

Affected versions: *-3.7.8
Patched versions: 3.7.8.1

Original Wordfence record

MediumCVE-2026-12904

Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter

Published: June 30, 2026

Affected versions: *-3.7.7
Patched versions: 3.7.8

Original Wordfence record

MediumCVE-2026-12902

Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions

Published: June 30, 2026

Affected versions: *-3.7.7
Patched versions: 3.7.8

Original Wordfence record

MediumCVE-2026-11357

Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

Published: June 17, 2026

Affected versions: *-3.7.5
Patched versions: 3.7.6

Original Wordfence record

MediumCVE-2026-2826

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload

Published: April 3, 2026

Affected versions: *-3.6.3
Patched versions: 3.6.4

Original Wordfence record

MediumCVE-2026-2633

Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload

Published: February 17, 2026

Affected versions: *-3.6.1
Patched versions: 3.6.2

Original Wordfence record

MediumCVE-2026-1857

Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter

Published: February 17, 2026

Affected versions: *-3.6.1
Patched versions: 3.6.2

Original Wordfence record

Highest-Severity Records

Critical

Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload

Published: August 9, 2023

Affected versions: [*, 3.1.11)
Patched versions: 3.1.11

Original Wordfence record

HighCVE-2023-6964

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)

Published: April 9, 2024

Affected versions: *-3.1.26
Patched versions: 3.2.12

Original Wordfence record

MediumCVE-2024-6884

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown

Published: July 18, 2024

Affected versions: *-3.2.28
Patched versions: 3.2.39

Original Wordfence record

MediumCVE-2024-24888

Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery

Published: March 29, 2024

Affected versions: *-3.2.25
Patched versions: 3.2.26

Original Wordfence record

MediumCVE-2024-4863

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter

Published: June 13, 2024

Affected versions: *-3.2.38
Patched versions: 3.2.39

Original Wordfence record

MediumCVE-2024-10785

Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: November 20, 2024

Affected versions: *-3.3.3
Patched versions: 3.3.4

Original Wordfence record

MediumCVE-2026-18435

Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute

Published: July 31, 2026

Affected versions: *-3.7.8
Patched versions: 3.7.8.1

Original Wordfence record

MediumCVE-2026-18062

Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

Published: July 31, 2026

Affected versions: *-3.7.8.1
Patched versions: 3.7.8.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory