Security Alert Summary
The Kadence Blocks – Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) issue via the ‘toggleIcon’ block attribute in all versions up to and including 3.7.8. Authenticated attackers with contributor-level access and above can inject scripts into pages that will execute whenever a user views an affected page.
CVE Details
- CVE ID:
CVE-2026-18435 - Affected component: Kadence Blocks – Page Builder Toolkit for Gutenberg Editor plugin for WordPress
- Affected versions: All versions up to and including 3.7.8
- Published: August 1, 2026 9:17 AM UTC
- Last modified: August 1, 2026 9:17 AM UTC
- CVSS v3.1: Base score 6.4 (MEDIUM) –
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Privileges Required: LOW (authenticated contributor-level or higher). User Interaction: NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting issue related to the block attribute named 'toggleIcon'. According to the advisory, insufficient input sanitization and output escaping for this attribute allows an authenticated user with contributor-level access or higher to store arbitrary web scripts in content produced by the block. When a site visitor or another authenticated user loads a page containing the injected content, the stored script can execute in the context of the page.
The issue exists because input provided to the 'toggleIcon' block attribute is not properly neutralized before being included in rendered output. The advisory does not name specific functions or REST endpoints beyond the block attribute, so remediation requires ensuring proper sanitization and escaping where the attribute value is handled and rendered.
How This Could Impact Your Website
Consider a site where the owner delegates content creation to internal staff and external contributors. A contributor who has access to add or edit blocks could supply a crafted value for the 'toggleIcon' attribute that includes script code. That script would be stored in the page content and run when other users view the page. Practical consequences include exposure of data visible to the page context, potential leakage of user-identifying information such as email addresses shown on the page, and an increased risk of targeted phishing or social engineering against staff and users who view the infected page.
The impact is scoped to what a stored XSS can achieve in the page context and does not by itself imply full site takeover. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior or unexpected content changes.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/blocks/class-kadence-blocks-table-of-contents-block.php#L293
- https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.7.8/includes/class-kadence-blocks-table-of-contents.php#L936
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3624906%40kadence-blocks&new=3624906%40kadence-blocks
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5f346cc7-92ad-4f76-a71c-864c22ed56b5?source=cve
