| 2026-10-21 |
WPSEC-2026-1371 |
Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Typed Text |
Medium 6.4 |
3.8.0.1 |
| 2026-10-21 |
WPSEC-2026-1370 |
Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up Block Prefix, Suffix and Separator |
Medium 6.4 |
3.8.0.1 |
| 2026-10-21 |
WPSEC-2026-1369 |
Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Block Number Prefix and Suffix |
Medium 6.4 |
3.8.0.1 |
| 2026-10-07 |
WPSEC-2026-0597 |
Kadence Blocks <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Block Title Heading Level |
Medium 6.4 |
3.7.12.1 |
| 2026-10-02 |
WPSEC-2026-0231 |
Kadence Blocks <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Link Block 'imageRatio' Attribute |
Medium 6.4 |
3.7.11.1 |
| 2026-10-01 |
WPSEC-2026-0193 |
Kadence Blocks <= 3.7.10 - Unauthenticated HTML Injection in Form Notification Emails via Uploaded File Name |
Medium 4.3 |
3.7.11 |
| 2026-10-01 |
WPSEC-2026-0017 |
Kadence Blocks <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload in Advanced Form |
Medium 6.1 |
3.7.12 |
