CVE-2026-39742 in Gutenberg Blocks by Kadence Blocks Plugin
Summary
by MITRE • 10/29/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the Kadence Blocks plugin for WordPress, developed by StellarWP and distributed under the Liquid Web umbrella. The issue arises from an insufficient sanitization mechanism when processing user-supplied input that is subsequently rendered in web pages without proper encoding or validation. This allows malicious actors to inject client-side scripts into legitimate web content, which are then executed by the browsers of unsuspecting users who view the affected page.
The technical root cause lies in the plugin's handling of data inputs across versions ranging from its initial release through version 3.8.0.2. In a typical WordPress environment using Gutenberg blocks, user input is often saved to the database and later retrieved for display. If the application fails to properly escape special characters such as angle brackets, quotes, or ampersands before outputting this data into HTML context, an attacker can craft malicious payloads that bypass existing filters. Because this is a stored vulnerability, the injected script persists on the server side rather than being confined to a single HTTP request like reflected XSS. This persistence ensures that every user who loads the compromised page will execute the malicious code, significantly amplifying the potential impact compared to non-persistent variants.
The operational impact of this Stored XSS vulnerability is severe and multifaceted. Attackers can exploit this flaw to steal session cookies, which may lead to account takeover if administrative credentials are captured or if users reuse passwords across sites. Furthermore, the malicious script can perform actions on behalf of the victim, such as modifying site content, defacing web pages, or redirecting users to phishing sites designed to harvest sensitive information. In environments where multiple user roles interact with the same blocks, an attacker could potentially escalate privileges by manipulating administrative interfaces if they manage to execute scripts within those contexts. The widespread use of Kadence Blocks means that any website utilizing this plugin is susceptible, creating a broad attack surface for automated scanning and exploitation campaigns targeting WordPress ecosystems.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It also maps to the MITRE ATT&CK framework under technique T1059, specifically Command and Scripting Interpretation via JavaScript, as well as T1189 Drive-by Client Execution. These mappings highlight the mechanism by which the attacker leverages web technologies to execute arbitrary code within the victim's browser environment. The persistence of the payload distinguishes it from reflected variants, placing it in a higher risk category due to its ability to affect multiple victims without requiring further interaction beyond initial page load.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary solution is for administrators to upgrade the Kadence Blocks plugin to version 3.8.0.3 or later, where this input validation issue has been resolved by developers through enhanced sanitization routines. Until an update is applied, site owners should consider implementing Web Application Firewall rules that detect and block common XSS payload patterns in POST requests associated with Gutenberg block settings. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on input/output handling practices are essential for preventing similar vulnerabilities in custom or third-party WordPress extensions.