Gutenberg Blocks by Kadence Blocks
Nexcess
Developer
3.7.1
Latest version
600,000
Installations
No date
Last updated
Vulnerability history
0 present
32 patched
2 Mitigation rules
- WordPress Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload vulnerability<= 3.6.306/04/2026
- WordPress Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload vulnerability<= 3.6.306/04/2026
- Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter vulnerability<= 3.6.117/02/2026
- Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload vulnerability<= 3.6.117/02/2026
- Incorrect Authorization to Authenticated (Contributor+) Post Publication vulnerability<= 3.5.3211/02/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect vulnerability<= 3.2.3702/02/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer vulnerability<= 3.2.3602/02/2026
- Authenticated (Admin+) Stored Cross-Site Scripting vulnerability<= 3.2.5330/01/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter vulnerability<= 3.5.1008/07/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' vulnerability<= 3.4.928/02/2025
- Broken Access Control vulnerability<= 3.3.124/01/2025
- Authenticated (contributor+) Stored Cross-Site Scripting via Button Link vulnerability<= 3.4.210/01/2025
- Admin+ Stored XSS vulnerability< 3.2.5412/12/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 3.3.321/11/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 3.3.131/10/2024
- Contributor+ Stored XSS via "Days Label" vulnerability< 3.2.3908/08/2024
- Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability<= 3.2.4501/07/2024
- Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability<= 3.2.4226/06/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter vulnerability<= 3.2.3814/06/2024
- Contributor+ Stored XSS vulnerability< 3.2.3715/05/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 3.2.3715/05/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link vulnerability<= 3.2.3610/05/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 3.2.3401/05/2024
- Authenticated Server-Side Request Forgery (SSRF) vulnerability<= 3.1.2611/04/2024
- Contributor+ Stored XSS vulnerability< 3.2.2605/04/2024
- Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown and CountUp Widget vulnerability<= 3.2.3104/04/2024
- Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings vulnerability<= 3.2.1703/04/2024
- Server Side Request Forgery (SSRF) vulnerability<= 3.2.2529/03/2024
- Server Side Request Forgery (SSRF) vulnerability<= 3.2.1926/03/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget vulnerability<= 3.2.2522/03/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 3.2.2314/03/2024
- Unauthenticated Arbitrary File Upload vulnerability<= 3.1.1009/08/2023