CVE-2026-104762 in Kadence Blocks Plugin
Summary
by MITRE • 10/10/2026
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This encoding bypass is only triggered when the "Load Google Fonts Locally" site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, which is not the default configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The Kadence Blocks plugin for WordPress presents a stored cross-site scripting vulnerability within its Block Font Family attribute functionality in versions up to and including 3.7.12. This security flaw stems from insufficient input sanitization and inadequate output escaping mechanisms when processing font family configurations. The vulnerability allows authenticated attackers who possess author-level access or higher privileges to inject arbitrary web scripts into page content. These injected payloads are stored within the database and execute automatically whenever any user accesses a page containing the malicious block, leading to potential session hijacking, defacement, or redirection attacks against site visitors.
The operational impact of this vulnerability is significant due to its persistent nature as a stored XSS attack vector. Unlike reflected cross-site scripting which requires tricking users into clicking a crafted link, this flaw embeds the malicious code directly within the page structure itself. Consequently, every user viewing the compromised page will trigger the execution of the attacker's script in their browser context. This can lead to unauthorized access to administrative functions if session cookies are stolen, manipulation of site content displayed to other users, or exploitation of client-side vulnerabilities through injected payloads. The severity is further compounded by the fact that it requires only author-level permissions rather than full administrator rights, expanding the pool of potential attackers within a typical WordPress installation environment.
A critical technical nuance governing this vulnerability is its dependency on specific site configuration settings. The encoding bypass and subsequent script execution are exclusively triggered when the Load Google Fonts Locally option, represented by kadence_blocks_font_settings['load_fonts_local'], is enabled in the plugin's global settings. This feature is not active by default in standard installations, which means that a significant portion of WordPress sites using Kadence Blocks remain unaffected unless this specific optimization setting has been manually activated. The vulnerability arises because when local font loading is engaged, the system processes and renders font family attributes through code paths that fail to properly sanitize special characters or escape output contexts appropriately before rendering them in HTML.
From an industry standards perspective, this issue aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored persistence where malicious input is saved and later rendered without proper validation. In terms of the MITRE ATT&CK framework for enterprise security, this vulnerability facilitates techniques associated with Initial Access via Valid Accounts and Execution through Browser Script Injection. Attackers can leverage these capabilities to establish persistent footholds within web applications or pivot further into networked environments if client-side exploits are chained with server-side access obtained through stolen credentials from the XSS payload.
Mitigation strategies should prioritize immediate updates for affected systems. Administrators running Kadence Blocks versions up to 3.7.12 must upgrade to a patched version that addresses these sanitization and escaping deficiencies in the Block Font Family attribute handling logic. For environments where upgrading is not immediately feasible, disabling the Load Google Fonts Locally setting effectively neutralizes this specific attack vector by preventing the vulnerable code path from being executed during page rendering. Additionally implementing strict Content Security Policy headers can help mitigate potential damage by restricting script execution sources and reducing the impact of successful XSS attempts even if they occur in unpatched systems. Regular security audits focusing on input validation across all user-editable fields within WordPress plugins are recommended to prevent similar vulnerabilities arising from inadequate sanitization practices.