Vulnerabilities and security researches for kadence-blocks

Direction: ascending

Jun 07, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # 7f8da6aa3ebf8eda56368739e88291da673770c1

CVE, Research URL: 7f8da6aa3ebf8eda56368739e88291da673770c1
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Aug 09, 2023
Research Description: Gutenberg Blocks with AI by Kadence WP – Page Builder Features [kadence-blocks] < 3.1.11 Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload The Kadence Blocks for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_fields function in versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-1999

CVE, Research URL: CVE-2024-1999
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 10, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-1541

CVE, Research URL: CVE-2024-1541
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Mar 13, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2919

CVE, Research URL: CVE-2024-2919
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 04, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CountUp Widget in all versions up to, and including, 3.2.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2023-6964

CVE, Research URL: CVE-2023-6964
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 10, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadence_import_get_new_connection_data' AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2273

CVE, Research URL: CVE-2024-2273
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: May 02, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.2.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4481

CVE, Research URL: CVE-2024-4481
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: May 14, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the plugin's blocks in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-23500

CVE, Research URL: CVE-2024-23500
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Mar 28, 2024
Research Description: Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.19.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2866

CVE, Research URL: -
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 10, 2024
Research Description: Rejected reason: ** REJECT ** Accidental reservation. Please use CVE-2024-2509.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-0598

CVE, Research URL: CVE-2024-0598
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 10, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form message settings in all versions up to and including 3.2.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-3189

CVE, Research URL: CVE-2024-3189
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: May 15, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial', 'Progress Bar', 'Lottie Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4209

CVE, Research URL: CVE-2024-4209
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: May 14, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown timer in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-24888

CVE, Research URL: CVE-2024-24888
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 03, 2024
Research Description: Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.25.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4208

CVE, Research URL: CVE-2024-4208
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: May 15, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in the advanced heading widget in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4057

CVE, Research URL: CVE-2024-4057
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Jun 04, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected versions: Min -, max -.
Status: vulnerable

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-2509

CVE, Research URL: CVE-2024-2509
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Apr 05, 2024
Research Description: The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected versions: Min -, max -.
Status: vulnerable

Jun 17, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-4863

CVE, Research URL: CVE-2024-4863
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Jun 14, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Jun 28, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-5289

CVE, Research URL: CVE-2024-5289
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Jun 27, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Jul 01, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-5819

CVE, Research URL: CVE-2024-5819
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Jun 29, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Aug 10, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-6884

CVE, Research URL: CVE-2024-6884
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Aug 08, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected versions: Min -, max -.
Status: vulnerable

Nov 02, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-9655

CVE, Research URL: CVE-2024-9655
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Nov 01, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Nov 21, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-10785

CVE, Research URL: CVE-2024-10785
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Nov 21, 2024
Research Description: Gutenberg Blocks with AI by Kadence WP – Page Builder Features [kadence-blocks] < 3.3.4 CVE-2024-10785 [en] The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Dec 12, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-10637

CVE, Research URL: CVE-2024-10637
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Dec 12, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected versions: Min -, max -.
Status: vulnerable

Dec 15, 2024

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-12581

CVE, Research URL: CVE-2024-12581
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Dec 13, 2024
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions: Min -, max -.
Status: vulnerable

Jan 11, 2025

Gutenberg Blocks by Kadence Blocks – Page Builder Features # CVE-2024-12304

CVE, Research URL: CVE-2024-12304
Application: Gutenberg Blocks by Kadence Blocks – Page Builder Features
Date: Jan 11, 2025
Research Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable