CVE-2024-2919

CVE-2024-2919 affects the Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting via the CountUp Widget in all versions up to 3.2.31, caused by insufficient input sanitization and output escaping on user-supplied attribu...

CVE-2024-1999

The WordPress plugin Gutenberg Blocks by Kadence Blocks – Page Builder Features is affected by CVE-2024-1999: Stored XSS via the Testimonial Widget anchor style parameter in versions up to 3.2.25. Exploitation requires at least Contributor‑level access and can lead to stored scripts executing on ...

CVE-2024-2509

The CVE-2024-2509 issue affects the WordPress plugin Gutenberg Blocks by Kadence Blocks (versions

CVE-2024-24888

CVE-2024-24888 is a Server-Side Request Forgery (SSRF) in Gutenberg Blocks powered by Kadence Blocks. The vulnerability affects the Kadence Blocks Gutenberg Blocks plugin for WordPress, specifically versions up to 3.2.25. According to the connected Red Hat advisory, the flaw enables a server-side...

CVE-2024-0598

CVE-2024-0598 describes a stored XSS in Gutenberg Blocks by Kadence Blocks – Page Builder Features for WordPress. The issue arises from insufficient input sanitization and output escaping in the contact form message settings, affecting all versions up to 3.2.17. It permits authenticated attackers...

CVE-2024-10637

The CVE concerns the Gutenberg Blocks with AI by Kadence WP WordPress plugin (before 3.2.54). It states that some block options are not properly validated/escaped before being output in the page/post where the block is embedded, enabling Stored Cross-Site Scripting. Affected surface: authenticate...

CVE-2024-1541

The Gutenberg Blocks by Kadence Blocks – Page Builder Features WordPress plugin (up to version 3.2.23) is affected by a Stored Cross-Site Scripting vulnerability via the htmlTag attribute due to insufficient input sanitization and output escaping. Exploitation requires authentication with Contrib...

CVE-2024-23500

CVE-2024-23500 affects Kadence WP Gutenberg Blocks (Kadence Blocks) for WordPress, with a Server-Side Request Forgery (SSRF) vulnerability present in Gutenberg Blocks versions through 3.2.19. The underlying issue is a misbehavior in how the plugin handles web requests originating from the applica...

CVE-2024-10785

CVE-2024-10785 : Gutenberg Blocks with AI by Kadence WP – Page Builder Features (Kadence Blocks) is vulnerable to Stored Cross-Site Scripting via the Countdown widget in versions

CVE-2025-24753

CVE-2025-24753 : Missing Authorization vulnerability in Kadence Blocks Gutenberg Blocks (Kadence Blocks) up to version 3.3.1. Root cause is incorrectly configured access control, enabling unauthorized actions. Affected product: Kadence Blocks Gutenberg Blocks. Impact is described as broken access...

CVE-2024-5819

CVE-2024-5819: Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored XSS via HTML data attributes due to insufficient input sanitization and output escaping. Affected versions include up to 3.2.45. Exploitation requires at least Cont...

CVE-2024-12304

CVE-2024-12304 affects Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress). The vulnerability is a Stored Cross-Site Scripting flaw via a button block link in all versions up to 3.4.2, caused by insufficient input sanitization and output escaping. Exploitation requires an a...

CVE-2023-6964

CVE-2023-6964 affects Gutenberg Blocks by Kadence Blocks – Page Builder Features for WordPress (all versions up to 3.1.26). It enables Server-Side Request Forgery via the kadence_import_get_new_connection_data AJAX action, allowing authenticated attackers with contributor+ access to issue web req...

CVE-2024-2273

CVE-2024-2273 affects Gutenberg Blocks by Kadence Blocks – Page Builder Features for WordPress. The flaw is a Stored Cross-Site Scripting (XSS) in multiple parameters due to insufficient input sanitization and output escaping, enabling an attacker with at least contributor privileges to inject we...

CVE-2024-6884

The CVE-2024-6884 entry concerns Gutenberg Blocks with AI by Kadence WP for WordPress. Affected software: Kadence Blocks plugin prior to version 3.2.39. Root cause: the block options are not properly validated/escaped before output in pages/posts where the block is embedded, enabling a Stored XSS...

CVE-2024-4863

CVE-2024-4863 applies to Gutenberg Blocks with AI by Kadence WP – Page Builder Features (Kadence Blocks) for WordPress. It is a Stored XSS via the titleFont parameter in all versions up to 3.2.38, exploitable by authenticated users with Contributor-level access and above to inject scripts that ru...

CVE-2024-9655

CVE-2024-9655 affects Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress). It is a Stored Cross-Site Scripting via the Icon widget in all versions

CVE-2024-12581

CVE-2024-12581 concerns the WordPress plugin Kadence Blocks (Gutenberg Blocks with AI by Kadence WP – Page Builder Features). Connected sources indicate the vulnerability is a Stored Cross-Site Scripting (XSS) in all versions up to 3.2.53, caused by insufficient input sanitization and output esca...

CVE-2024-4208

CVE-2024-4208: Gutenberg Blocks with AI by Kadence Blocks – Page Builder Features (WordPress) is vulnerable to Stored Cross‑Site Scripting via the Typer Effect in the Advanced Heading widget for all versions up to and including 3.2.37 due to insufficient input sanitization and output escaping on ...

CVE-2024-3189

CVE-2024-3189 affects Gutenberg Blocks by Kadence Blocks – Page Builder Features for WordPress. All versions ≤ 3.2.37 are vulnerable to Stored XSS via the plugin blocks (Testimonial, Progress Bar, Lottie Animations, Row Layout, Google Maps, Advanced Gallery) due to insufficient input sanitization...

CVE-2024-4057

The CVE-2024-4057 issue affects Gutenberg Blocks with AI by Kadence WP for WordPress, where certain block attributes are not validated/escaped before they are output in a page/post containing the block. This can allow stored XSS by users with contributor role and above. Root cause: output of unva...

CVE-2024-4481

CVE-2024-4481 affects Gutenberg Blocks with AI by Kadence WP (WordPress). The WordPress plugin Kadence Blocks vulnerability allows Stored XSS via the link attribute in blocks across all versions up to 3.2.36. attacker requires at least contributor-level authentication to inject scripts into pages...

CVE-2024-4209

The vulnerability CVE-2024-4209 affects Gutenberg Blocks with AI by Kadence Blocks – Page Builder Features for WordPress. It is a Stored Cross-Site Scripting (XSS) via the countdown timer in versions up to 3.2.36, caused by insufficient input sanitization and output escaping on user-supplied attr...

CVE-2024-5289

CVE-2024-5289 affects Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress). It enables stored XSS via Google Maps widget parameters in all versions up to 3.2.42, due to insufficient input sanitization and output escaping. Exploitation requires Contributor-level authenticatio...

CVE-2025-5678

CVE-2025-5678 : Kadence Blocks – Gutenberg Blocks for Page Builder Features (WordPress) is affected by a Stored Cross-Site Scripting (XSS) via the redirectURL parameter in all versions up to 3.5.10. The vulnerability allows authenticated attackers with Contributor-level access and above to inject...