Kadence Blocks <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload in Advanced Form
- ID
- WPSEC-2026-0017
- Plugin
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (kadence-blocks)
- Affected
- from 3.4.9 before 3.7.12
- Remediation
- Update to 3.7.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Kadence Blocks on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-103354, on 2026-10-02.
Description
The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in the Advanced Form file field in versions 3.4.9 up to, and including, 3.7.11.1. This is due to the 'Design' file category permitting SVG/SVGZ uploads without sanitizing their content. This makes it possible for unauthenticated attackers to upload SVG files containing arbitrary JavaScript, which executes in the site's origin when an administrator or other user opens the uploaded file (for example from the submission notification email). Exploitation requires a published Advanced Form whose file field allows the Design file category.
References
- https://wpsec.com/vuln/WPSEC-2026-0017/
- https://plugins.svn.wordpress.org/kadence-blocks/tags/3.7.12/
- https://wordpress.org/plugins/kadence-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS