Kadence Blocks <= 3.7.10 - Unauthenticated HTML Injection in Form Notification Emails via Uploaded File Name
- ID
- WPSEC-2026-0193
- Plugin
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (kadence-blocks)
- Affected
- from 3.1.21 before 3.7.11
- Remediation
- Update to 3.7.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-80
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Kadence Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The Kadence Blocks plugin for WordPress is vulnerable to HTML Injection in form notification emails in versions 3.1.21 up to, and including, 3.7.10. This is due to the form email template inserting the original names of files submitted through an Advanced Form File field into the HTML notification email without escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML into the notification emails sent to site administrators or other configured recipients, which could be used for phishing if a recipient interacts with the injected content. Exploitation requires a published Advanced Form with a File field and HTML notification emails enabled (the default).
References
- https://wpsec.com/vuln/WPSEC-2026-0193/
- https://plugins.svn.wordpress.org/kadence-blocks/tags/3.7.11/
- https://wordpress.org/plugins/kadence-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS