¿Es seguro Kadence Blocks?

Qué hace este plugin

• Slug: kadence-blocks
• 600000+ instalaciones activas

blockseditorgutenberggutenberg blockspage builder

Estado de mantenimiento

• Última versión conocida: 3.7.8
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

35 CVEs conocidos registrados para Kadence Blocks.

CVE-2026-15286

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'get_items_permission_check' function permission callback of the 'process_pattern' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and immediately publish posts of any type (including pages), bypassing the standard WordPress review workflow where contributors must submit posts for administrator approval.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-12902

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-12904

The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints — authorization is checked via current_user_can('edit_post'/'delete_post', $post_id) against the user-supplied post_id, while the storage layer keys analysis records on sha256($post_path) from a separately supplied, attacker-controlled post_path parameter, with no enforcement that post_path corresponds to post_id. This makes it possible for authenticated attackers, with Contributor-level access and above, to read or delete optimizer analysis records belonging to posts owned by other users by submitting their own post_id (which passes the capability check) together with the victim post's path.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editor_assets_variables. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's connected Kadence account license key, license owner email, api_key, api_email, and license domain from the browser console by inspecting window.kadence_blocks_params.proData. Exploitation requires only that an administrator has previously connected a valid Kadence license; the full credential bundle is then readable by any Contributor-level user from the block editor client context without any server-side request manipulation.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.6.0

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'get_items_permission_check' function permission callback of the 'process_pattern' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and immediately publish posts of any type (including pages), bypassing the standard WordPress review workflow where contributors must submit posts for administrator approval.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-24753

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-12304

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-10637

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 30 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-12581	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.54	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,4	< 3.2.54	3.2.54	2024-11-21	✓ corregido en la última versión
CVE-2024-10785	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.3.4	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 3.3.4	3.3.4	2024-11-20	✓ corregido en la última versión
CVE-2024-9655	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.3.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.3.2	3.3.2	2024-10-31	✓ corregido en la última versión
CVE-2024-6884	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.39	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.39	3.2.39	2024-07-18	✓ corregido en la última versión
CVE-2024-5819	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.46	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.46	3.2.46	2024-06-28	✓ corregido en la última versión
CVE-2024-5289	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.43	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.43	3.2.43	2024-06-26	✓ corregido en la última versión
CVE-2024-4863	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.39	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.39	3.2.39	2024-06-13	✓ corregido en la última versión
CVE-2024-3189	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.38	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.38	3.2.38	2024-05-14	✓ corregido en la última versión
CVE-2024-4208	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.38	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.38	3.2.38	2024-05-14	✓ corregido en la última versión
CVE-2024-4057	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.37	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 3.2.37	3.2.37	2024-05-14	✓ corregido en la última versión
CVE-2024-4209	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.37	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.37	3.2.37	2024-05-10	✓ corregido en la última versión
CVE-2024-4481	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.37	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.37	3.2.37	2024-05-09	✓ corregido en la última versión
CVE-2024-2273	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.35	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.35	3.2.35	2024-05-01	✓ corregido en la última versión
CVE-2023-6964	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.12	Falsificación de petición del lado del servidor (SSRF)	Media 6,4	< 3.2.12	3.2.12	2024-04-09	✓ corregido en la última versión
CVE-2024-2509	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.26	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,5	< 3.2.26	3.2.26	2024-04-05	✓ corregido en la última versión
CVE-2024-2919	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.32	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.32	3.2.32	2024-04-03	✓ corregido en la última versión
CVE-2024-0598	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.18	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.2.18	3.2.18	2024-04-02	✓ corregido en la última versión
CVE-2024-24888	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.26	Falsificación de petición del lado del servidor (SSRF)	Media 6,4	< 3.2.26	3.2.26	2024-03-29	✓ corregido en la última versión
CVE-2024-23500	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.20	Falsificación de petición del lado del servidor (SSRF)	Alta 7,7	< 3.2.20	3.2.20	2024-03-26	✓ corregido en la última versión
CVE-2024-1999	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.26	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.26	3.2.26	2024-03-21	✓ corregido en la última versión
CVE-2024-2866	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.26	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Desconocido	< 3.2.26	3.2.26	2024-03-15	✓ corregido en la última versión
CVE-2024-1541	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.2.24	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.2.24	3.2.24	2024-03-01	✓ corregido en la última versión
—	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.1.11	—	Desconocido	< 3.1.11	3.1.11	2023-08-09	✓ corregido en la última versión
—	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.1.11	—	Desconocido	< 3.1.11	3.1.11	2023-08-09	✓ corregido en la última versión
CVE-2025-1291	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.4.10	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 3.4.10	3.4.10	0000-00-00	✓ corregido en la última versión
CVE-2025-5678	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.5.11	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.5.11	3.5.11	0000-00-00	✓ corregido en la última versión
CVE-2026-2826	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.6.4	—	Desconocido	< 3.6.4	3.6.4	0000-00-00	✓ corregido en la última versión
CVE-2026-2633	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.6.2	—	Desconocido	< 3.6.2	3.6.2	0000-00-00	✓ corregido en la última versión
CVE-2026-1857	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.6.2	—	Desconocido	< 3.6.2	3.6.2	0000-00-00	✓ corregido en la última versión
CVE-2026-2608	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.6.0	—	Desconocido	< 3.6.0	3.6.0	0000-00-00	✓ corregido en la última versión

CVE-2024-12581

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-10785

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-9655

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6884

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Block in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping on the Days Label. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-5819

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-5289

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4863

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3189

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial', 'Progress Bar', 'Lottie Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4208

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in the advanced heading widget in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4057

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fileUrl attribute in versions up to, and including 3.2.36, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-4209

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown timer in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4481

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the plugin's blocks in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2273

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.2.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-6964

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.12). Lucio Sá discovered and reported this Server Side Request Forgery (SSRF) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information of other services running on the system. This vulnerability has been fixed in version 3.2.12. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2509

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.26). Dmitrii Ignatyev discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.26. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2919

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.32). Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.32. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-0598

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.18). Akbar Kustirama discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.18. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-24888

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.26). Kursat Cetin discovered and reported this Server Side Request Forgery (SSRF) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information of other services running on the system. This vulnerability has been fixed in version 3.2.26. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-23500

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.20). Rafie Muhammad (Patchstack) discovered and reported this Server Side Request Forgery (SSRF) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information of other services running on the system. This vulnerability has been fixed in version 3.2.20. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-1999

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.26). wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.26. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2866

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Form widget in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping on user supplied attributes such as 'placeholder'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-1541

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.2.24). wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.24. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.1.11

The Kadence Blocks for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_fields function in versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.1.11

Update the WordPress Gutenberg Blocks by Kadence Blocks plugin to the latest available version (at least 3.1.11). An unknown person discovered and reported this Arbitrary File Upload vulnerability in WordPress Gutenberg Blocks by Kadence Blocks Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 3.1.11.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2025-1291

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-5678

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-2826

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the `upload_files` capability in the `process_pattern` REST API endpoint. This makes it possible for authenticated attackers, with contributor level access and above, to upload images to the WordPress Media Library by supplying remote image URLs that the server downloads and creates as media attachments.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-2633

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-1857

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the `endpoint` parameter in the `get_items()` function of the GetResponse REST API handler. The endpoint's permission check only requires `edit_posts` capability (Contributor role) rather than `manage_options` (Administrator). This makes it possible for authenticated attackers, with Contributor-level access and above, to make server-side requests to arbitrary endpoints on the configured GetResponse API server, retrieving sensitive data such as contacts, campaigns, and mailing lists using the site's stored API credentials. The stored API key is also leaked in the request headers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-2608

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Kadence Blocks actualizado — 3.7.8 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Elementor Website Builder – more than just a page builder — 10000000+ instalaciones activas — 90/100 (7277)
• Classic Editor — 9000000+ instalaciones activas — 98/100 (1242) — PHP máx. 8.4
• Classic Widgets — 2000000+ instalaciones activas — 98/100 (272) — PHP máx. 8.4
• Advanced Editor Tools — 1000000+ instalaciones activas — 90/100 (354) — PHP máx. 8.4
• Spectra Gutenberg Blocks – Website Builder for the Block Editor — 1000000+ instalaciones activas — 94/100 (1869) — PHP máx. 8.4