Lucene search
+L

204 matches found

EUVD
EUVD
added 2 days ago11 views

EUVD-2026-51748

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.7AI score0.00193EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago8 views

CVE-2026-18435

Kadence Blocks (WordPress)

6.4CVSS5.7AI score0.00193EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2 days ago6 views

CVE-2026-18435

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.7AI score0.00193EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2 days ago6 views

CVE-2026-18062

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

6.4CVSS5.8AI score0.00206EPSS
SaveExploits0References9
EUVD
EUVD
added 2 days ago9 views

EUVD-2026-51749

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

6.4CVSS5.8AI score0.00206EPSS
SaveExploits0References8
CVE
CVE
added 2 days ago8 views

CVE-2026-18062

CVE-2026-18062 affects Kadence Blocks — Page Builder Toolkit for Gutenberg Editor for WordPress, version ≤ 3.7.8.1. The issue is a Stored Cross-Site Scripting vulnerability in the Identity Block Inner Image Content path caused by insufficient input sanitization and output escaping. Exploitation r...

6.4CVSS5.8AI score0.00206EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2 days ago32 views

CVE-2026-18062 Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

6.4CVSS0.00206EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/10 4:31 a.m.18 views

CVE-2026-15286

The CVE-2026-15286 entry concerns the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress. Affected component: a misconfigured capability check on the get_items_permission_check function within the process_pattern REST API endpoint, which affects all versions up to...

4.3CVSS5.9AI score0.00268EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/01 5:16 a.m.15 views

CVE-2026-12904

The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the...

4.3CVSS0.00293EPSS
SaveExploits0References20
NVD
NVD
added 2026/07/01 5:16 a.m.13 views

CVE-2026-12902

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

4.3CVSS0.00272EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/07/01 3:43 a.m.9 views

CVE-2026-12902

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

4.3CVSS5.9AI score0.00272EPSS
SaveExploits0References11
CVE
CVE
added 2026/07/01 3:43 a.m.27 views

CVE-2026-12902

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (WordPress) contains an authorization bypass in all versions up to 3.7.7. Authenticated attackers with contributor-level access can create arbitrary Media Library attachments by downloading remote images into the uploads directory via wp_...

4.3CVSS5.9AI score0.00272EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/01 3:43 a.m.41 views

CVE-2026-12902 Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

4.3CVSS0.00272EPSS
SaveExploits0References10
EUVD
EUVD
added 2026/07/01 3:43 a.m.16 views

EUVD-2026-40895

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

4.3CVSS5.9AI score0.00272EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/01 3:43 a.m.34 views

CVE-2026-12904

The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress (versions ≤ 3.7.7) is affected by an Insecure Direct Object Reference. The root cause is a mismatch between the authorization object and the object actually accessed in Optimize_Rest_Controller endpoints (create_...

4.3CVSS5.8AI score0.00293EPSS
SaveExploits0References20
Cvelist
Cvelist
added 2026/07/01 3:43 a.m.48 views

CVE-2026-12904 Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter

The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the...

4.3CVSS0.00293EPSS
SaveExploits0References20
EUVD
EUVD
added 2026/07/01 3:43 a.m.15 views

EUVD-2026-40890

The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the...

4.3CVSS5.8AI score0.00293EPSS
SaveExploits0References20
NVD
NVD
added 2026/06/18 6:16 a.m.16 views

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

4.3CVSS0.00322EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
added 2026/06/18 4:31 a.m.11 views

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

4.3CVSS5.3AI score0.00322EPSS
SaveExploits0References9
CVE
CVE
added 2026/06/18 4:31 a.m.41 views

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress (versions up to and including 3.7.5) contains a Sensitive Information Exposure flaw in editor_assets_variables. Authenticated attackers with contributor-level access can extract license key, license owner email, a...

4.3CVSS5.3AI score0.00322EPSS
SaveExploits0References8
Rows per page
Query Builder