---
title: "StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/stellarwp/kadence-blocks-page-builder-toolkit-for-gutenberg-editor
type: product
description: "StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor has 30 published CVEs, 0 in CISA KEV and 2 with public exploits."
updated: 2026-10-10
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor vulnerabilities

Vendor: [StellarWP](https://radicalnotion.ai/vendor/stellarwp)

- **Published CVEs:** 30
- **In CISA KEV:** 0
- **With a public exploit:** 2
- **With a patch:** 30
- **Average CVSS:** 5.8
- **First CVE:** 2024-03-13
- **Latest CVE:** 2026-10-10

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 0 |
| High | 1 |
| Medium | 29 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 21 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 4 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 2 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 |
| [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 1 |
| [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2024 | 16 |
| 2025 | 3 |
| 2026 | 11 |

## Affected versions (top 12 of 25)

| Version | Kind | CVEs |
| --- | --- | --- |
| \<= 3.2.36 | range | 2 |
| \<= 3.2.37 | range | 2 |
| \<= 3.5.32 | range | 2 |
| \<= 3.6.1 | range | 2 |
| \<= 3.7.7 | range | 2 |
| \<= 3.1.26 | range | 1 |
| \<= 3.2.17 | range | 1 |
| \<= 3.2.23 | range | 1 |
| \<= 3.2.25 | range | 1 |
| \<= 3.2.31 | range | 1 |
| \<= 3.2.34 | range | 1 |
| \<= 3.2.38 | range | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-104762 | Kadence Blocks \<= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute | medium | 6.4 | No | No | Yes |
| CVE-2026-18062 | Kadence Blocks \<= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content | medium | 6.4 | No | No | Yes |
| CVE-2026-18435 | Kadence Blocks \<= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute | medium | 6.4 | No | No | Yes |
| CVE-2026-15286 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication | medium | 4.3 | No | No | Yes |
| CVE-2026-12902 | Kadence Blocks \<= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence\_import\_process\_pattern/kadence\_import\_process\_data AJAX Actions | medium | 4.3 | No | No | Yes |
| CVE-2026-12904 | Kadence Blocks \<= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post\_path' Parameter | medium | 4.3 | No | No | Yes |
| CVE-2026-11357 | Kadence Blocks \<= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization | medium | 4.3 | No | No | Yes |
| CVE-2026-2826 | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor \<= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload | medium | 4.3 | No | No | Yes |
| CVE-2026-2633 | Gutenberg Blocks with AI by Kadence WP \<= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload | medium | 4.3 | No | No | Yes |
| CVE-2026-1857 | Gutenberg Blocks with AI by Kadence WP \<= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter | medium | 4.3 | No | No | Yes |
| CVE-2026-2608 | Gutenberg Blocks by Kadence Blocks \<= 3.5.32 - Missing Authorization | medium | 4.3 | No | No | Yes |
| CVE-2025-5678 | Kadence Blocks – Gutenberg Blocks for Page Builder Features \<= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`redirectURL\` Parameter | medium | 6.4 | No | No | Yes |
| CVE-2025-1291 | Gutenberg Blocks by Kadence Blocks \<= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' | medium | 6.4 | No | No | Yes |
| CVE-2024-12304 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link | medium | 6.4 | No | No | Yes |
| CVE-2024-12581 | Kadence Blocks \<= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting | medium | 4.8 | No | Yes | Yes |
| CVE-2024-10785 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes |
| CVE-2024-9655 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget | medium | 6.4 | No | No | Yes |
| CVE-2024-5819 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes | medium | 6.4 | No | No | Yes |
| CVE-2024-5289 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget | medium | 6.4 | No | No | Yes |
| CVE-2024-4863 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter | medium | 6.4 | No | No | Yes |
| CVE-2024-4208 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect | medium | 6.4 | No | No | Yes |
| CVE-2024-3189 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 5.4 | No | No | Yes |
| CVE-2024-4209 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer | medium | 6.4 | No | No | Yes |
| CVE-2024-4481 | Gutenberg Blocks with AI by Kadence WP \<= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link | medium | 6.4 | No | No | Yes |
| CVE-2024-2273 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes |
| CVE-2024-1999 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget | medium | 6.4 | No | No | Yes |
| CVE-2023-6964 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) | high | 8.5 | No | No | Yes |
| CVE-2024-0598 | Gutenberg Blocks by Kadence Blocks \<= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings | medium | 4.8 | No | Yes | Yes |
| CVE-2024-2919 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget | medium | 6.4 | No | No | Yes |
| CVE-2024-1541 | Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes |

## Frequently asked questions

### How many CVEs does StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor have?

StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor has 30 published CVE records since 2024.

### How many StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor CVEs are in CISA KEV?

None of StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor vulnerabilities?

Yes — 2 of StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor's CVEs have a known public exploit.

### Which versions of StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor are affected?

25 distinct StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor CVEs?

StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

### What is the average severity of StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor CVEs?

The average CVSS base score across StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor's scored CVEs is 5.8.

## Other products from this vendor

- [GiveWP – Donation Plugin and Fundraising Platform](https://radicalnotion.ai/vendor/stellarwp/givewp-donation-plugin-and-fundraising-platform) (34 CVEs)
- [The Events Calendar](https://radicalnotion.ai/vendor/stellarwp/the-events-calendar) (26 CVEs)
- [Event Tickets and Registration](https://radicalnotion.ai/vendor/stellarwp/event-tickets-and-registration) (8 CVEs)
- [GiveWP](https://radicalnotion.ai/vendor/stellarwp/givewp) (8 CVEs)
- [LearnDash LMS](https://radicalnotion.ai/vendor/stellarwp/learndash-lms) (7 CVEs)
- [Membership Plugin – Restrict Content](https://radicalnotion.ai/vendor/stellarwp/membership-plugin-restrict-content) (7 CVEs)
- [WPComplete](https://radicalnotion.ai/vendor/stellarwp/wpcomplete) (4 CVEs)
- [Bookit — Booking & Appointment Calendar](https://radicalnotion.ai/vendor/stellarwp/bookit-booking-and-appointment-calendar) (3 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/stellarwp/kadence-blocks-page-builder-toolkit-for-gutenberg-editor). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.