CVE-2026-105890 in Gutenberg Blocks by Kadence Blocks Plugin
Summary
by MITRE • 10/08/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the Gutenberg Blocks by Kadence Blocks plugin for WordPress, affecting versions ranging from its initial release through version 3.7.12. In web application security taxonomy, stored XSS is considered particularly severe because malicious scripts are permanently stored on the target server, typically in a database or content management system, and are subsequently served to every user who views the affected page. This distinguishes it from reflected XSS, where the payload must be actively injected by an attacker via a crafted link, as well as DOM-based XSS which occurs entirely within the client-side code without server interaction. The presence of this vulnerability in a widely used block editor plugin significantly expands the attack surface for WordPress sites that rely on Kadence Blocks to construct their layouts and content structures.
The technical root cause lies in the insufficient sanitization or validation of user-supplied input before it is rendered into HTML output within the Gutenberg block interface. When an administrator, editor, or potentially any authenticated user with permission to create or modify posts containing these specific blocks enters data that includes executable JavaScript code, the application fails to neutralize special characters such as angle brackets, quotes, and ampersands. Consequently, when another user loads a page containing this compromised content, their browser interprets the injected script as legitimate code originating from the trusted domain of the website. This breach of trust allows the attacker to execute arbitrary scripts in the context of the victim's session. The vulnerability likely resides in how the plugin handles attributes or settings passed through the block editor’s REST API or frontend rendering logic, where input is accepted without rigorous encoding checks against known injection patterns defined by industry standards such as CWE-79.
The operational impact of this stored XSS vulnerability extends far beyond simple defacement or nuisance alerts. An attacker can exploit this flaw to steal session cookies and authentication tokens, effectively hijacking user sessions for administrators or editors who view the infected content. This could lead to full compromise of the WordPress dashboard, allowing the installation of backdoors, modification of site settings, or deployment of further malware such as phishing pages designed to harvest credentials from other visitors. Furthermore, attackers can manipulate page content dynamically, redirect users to malicious sites, or perform actions on behalf of the victim without their knowledge. Since Gutenberg blocks are often used for core structural elements like headers, footers, and main content areas, the visibility of this vulnerability is high, increasing the likelihood that multiple site visitors will trigger the payload simply by browsing the affected pages. This aligns with MITRE ATT&CK techniques related to Client-side Scripting Injection (T1059) and potentially Account Manipulation or Credential Access depending on the specific exploitation path taken.
Mitigation strategies must prioritize immediate remediation through software updates, as the vendor has addressed this issue in versions subsequent to 3.7.12. Site administrators should upgrade Kadence Blocks to the latest stable release where input validation mechanisms have been hardened according to secure coding practices. In scenarios where an immediate update is not feasible due to compatibility concerns or deployment delays, temporary compensating controls are necessary. These include implementing a Web Application Firewall that can detect and block common XSS payloads in HTTP requests and responses, as well as enforcing strict Content Security Policy headers on the web server to restrict the execution of inline scripts unless explicitly whitelisted. Additionally, developers should review any custom code interacting with Kadence Blocks APIs to ensure that all user inputs are properly escaped using context-aware encoding functions provided by the WordPress framework before being outputted to the browser. Regular security audits and penetration testing focused on input validation across block attributes will help prevent similar vulnerabilities in future development cycles.