Plugin security history

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 37 vulnerability records associated with Kadence Blocks — Page Builder Toolkit for Gutenberg Editor, published between 2023 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

37Total records

1Critical

1High

35Medium

0Low

0Informational

37Patched records

0Currently marked unpatched

2023-08-09First disclosure

2026-07-31Latest disclosure

36 of 37CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	1	1 records
2024	22	22 records
2025	4	4 records
2026	10	10 records

Severity Breakdown

Severity	Records	Share
Critical	1	2.7%
High	1	2.7%
Medium	35	94.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

24 records64.9%

First: 2024. Latest: 2026.

Missing Authorization

7 records18.9%

First: 2025. Latest: 2026.

Other

4 records10.8%

First: 2024. Latest: 2026.

Arbitrary File Upload

1 record2.7%

First: 2023. Latest: 2023.

Information Disclosure

1 record2.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 37
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.7.8.2
3.7.8.1
3.7.8
3.7.6
3.6.4
3.6.2
3.6.0
3.5.11
3.4.10
3.3.2
3.4.3
3.2.54
3.3.4
3.2.39
3.2.46
3.2.43
3.2.38
3.2.37
3.2.35
3.2.12
3.2.32
3.2.18
3.2.26
3.2.20
3.2.24
3.1.11

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.2.36`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer	May 10, 2024	3.2.37	Medium
`*-3.2.36`	Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link	May 9, 2024	3.2.37	Medium
`*-3.2.34`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 1, 2024	3.2.35	Medium
`*-3.1.26`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)	April 9, 2024	3.2.12	High
`*-3.2.31`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget	April 3, 2024	3.2.32	Medium
`*-3.2.17`	Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings	April 2, 2024	3.2.18	Medium
`*-3.2.25`	Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery	March 29, 2024	3.2.26	Medium
`*-3.2.19`	Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.19 - Authenticated (Contributor+) Server-Side Request Forgery	March 26, 2024	3.2.20	Medium
`*-3.2.25`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget	March 21, 2024	3.2.26	Medium
`*-3.2.25`	Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 15, 2024	3.2.26	Medium
`*-3.2.23`	Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 1, 2024	3.2.24	Medium
`[*, 3.1.11)`	Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload	August 9, 2023	3.1.11	Critical

Selected source records

Latest Records

MediumCVE-2026-18062

Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

Published: July 31, 2026

Affected versions: *-3.7.8.1
Patched versions: 3.7.8.2

Original Wordfence record

MediumCVE-2026-18435

Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute

Published: July 31, 2026

Affected versions: *-3.7.8
Patched versions: 3.7.8.1

Original Wordfence record

MediumCVE-2026-12904

Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter

Published: June 30, 2026

Affected versions: *-3.7.7
Patched versions: 3.7.8

Original Wordfence record

MediumCVE-2026-12902

Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions

Published: June 30, 2026

Affected versions: *-3.7.7
Patched versions: 3.7.8

Original Wordfence record

MediumCVE-2026-11357

Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

Published: June 17, 2026

Affected versions: *-3.7.5
Patched versions: 3.7.6

Original Wordfence record

MediumCVE-2026-2826

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload

Published: April 3, 2026

Affected versions: *-3.6.3
Patched versions: 3.6.4

Original Wordfence record

MediumCVE-2026-2633

Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload

Published: February 17, 2026

Affected versions: *-3.6.1
Patched versions: 3.6.2

Original Wordfence record

MediumCVE-2026-1857

Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter

Published: February 17, 2026

Affected versions: *-3.6.1
Patched versions: 3.6.2

Original Wordfence record

Highest-Severity Records

Critical

Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload

Published: August 9, 2023

Affected versions: [*, 3.1.11)
Patched versions: 3.1.11

Original Wordfence record

HighCVE-2023-6964

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)

Published: April 9, 2024

Affected versions: *-3.1.26
Patched versions: 3.2.12

Original Wordfence record

MediumCVE-2024-6884

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown

Published: July 18, 2024

Affected versions: *-3.2.28
Patched versions: 3.2.39

Original Wordfence record

MediumCVE-2024-24888

Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery

Published: March 29, 2024

Affected versions: *-3.2.25
Patched versions: 3.2.26

Original Wordfence record

MediumCVE-2024-4863

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter

Published: June 13, 2024

Affected versions: *-3.2.38
Patched versions: 3.2.39

Original Wordfence record

MediumCVE-2024-10785

Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: November 20, 2024

Affected versions: *-3.3.3
Patched versions: 3.3.4

Original Wordfence record

MediumCVE-2026-18435

Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute

Published: July 31, 2026

Affected versions: *-3.7.8
Patched versions: 3.7.8.1

Original Wordfence record

MediumCVE-2026-18062

Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

Published: July 31, 2026

Affected versions: *-3.7.8.1
Patched versions: 3.7.8.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory