cleantalk

Vulnerabilities and Security Researches

Vulnerabilities and security researches for kadence-blocks

Direction: ascending

Jun 07, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # 7f8da6aa3ebf8eda56368739e88291da673770c1

Date
Aug 09, 2023
Research Description
Gutenberg Blocks with AI by Kadence WP – Page Builder Features [kadence-blocks] < 3.1.11 Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload The Kadence Blocks for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_fields function in versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-1999

CVE, Research URL

CVE-2024-1999

Date
Apr 10, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-1541

CVE, Research URL

CVE-2024-1541

Date
Mar 13, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2919

CVE, Research URL

CVE-2024-2919

Date
Apr 04, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CountUp Widget in all versions up to, and including, 3.2.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2023-6964

CVE, Research URL

CVE-2023-6964

Date
Apr 10, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadence_import_get_new_connection_data' AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2273

CVE, Research URL

CVE-2024-2273

Date
May 02, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.2.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4481

CVE, Research URL

CVE-2024-4481

Date
May 14, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the plugin's blocks in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-23500

CVE, Research URL

CVE-2024-23500

Date
Mar 28, 2024
Research Description
Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.19.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2866

CVE, Research URL

-

Date
Apr 10, 2024
Research Description
Rejected reason: ** REJECT ** Accidental reservation. Please use CVE-2024-2509.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-0598

CVE, Research URL

CVE-2024-0598

Date
Apr 10, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form message settings in all versions up to and including 3.2.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-3189

CVE, Research URL

CVE-2024-3189

Date
May 15, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial', 'Progress Bar', 'Lottie Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4209

CVE, Research URL

CVE-2024-4209

Date
May 14, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown timer in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-24888

CVE, Research URL

CVE-2024-24888

Date
Apr 03, 2024
Research Description
Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.25.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4208

CVE, Research URL

CVE-2024-4208

Date
May 15, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in the advanced heading widget in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4057

CVE, Research URL

CVE-2024-4057

Date
Jun 04, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected versions
Min -, max -.
Status
vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2509

CVE, Research URL

CVE-2024-2509

Date
Apr 05, 2024
Research Description
The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected versions
Min -, max -.
Status
vulnerable

Jun 17, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4863

CVE, Research URL

CVE-2024-4863

Date
Jun 14, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Jun 28, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-5289

CVE, Research URL

CVE-2024-5289

Date
Jun 27, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Jul 01, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-5819

CVE, Research URL

CVE-2024-5819

Date
Jun 29, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Aug 10, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-6884

CVE, Research URL

CVE-2024-6884

Date
Aug 08, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected versions
Min -, max -.
Status
vulnerable

Nov 02, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-9655

CVE, Research URL

CVE-2024-9655

Date
Nov 01, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Nov 21, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-10785

CVE, Research URL

CVE-2024-10785

Date
Nov 21, 2024
Research Description
Gutenberg Blocks with AI by Kadence WP – Page Builder Features [kadence-blocks] < 3.3.4 CVE-2024-10785 [en] The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable

Dec 12, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-10637

CVE, Research URL

CVE-2024-10637

Date
Dec 12, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected versions
Min -, max -.
Status
vulnerable

Dec 15, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-12581

CVE, Research URL

CVE-2024-12581

Date
Dec 13, 2024
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions
Min -, max -.
Status
vulnerable

Jan 11, 2025

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-12304

CVE, Research URL

CVE-2024-12304

Date
Jan 11, 2025
Research Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max -.
Status
vulnerable