Gutenberg Blocks by Kadence Blocks

StellarWP

Developer

3.6.2

Latest version

500,000

Installations

No date

Last updated

WordPress Plugin

Active VDP

Report vulnerability

Vulnerabilities

Security Policy

Security Contributors

Vulnerability history

0 present

27 fixed

2 Mitigation rules

Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect vulnerability
<= 3.2.37
Feb 2, 2026
Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer vulnerability
<= 3.2.36
Feb 2, 2026
Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
<= 3.2.53
Jan 30, 2026
Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter vulnerability
<= 3.5.10
Jul 8, 2025
Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' vulnerability
<= 3.4.9
Feb 28, 2025
Broken Access Control vulnerability
<= 3.3.1
Jan 24, 2025
Authenticated (contributor+) Stored Cross-Site Scripting via Button Link vulnerability
<= 3.4.2
Jan 10, 2025
Admin+ Stored XSS vulnerability
< 3.2.54
Dec 12, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
<= 3.3.3
Nov 21, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
<= 3.3.1
Oct 31, 2024
Contributor+ Stored XSS via "Days Label" vulnerability
< 3.2.39
Aug 8, 2024
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability
<= 3.2.45
Jul 1, 2024
Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability
<= 3.2.42
Jun 26, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter vulnerability
<= 3.2.38
Jun 14, 2024
Contributor+ Stored XSS vulnerability
< 3.2.37
May 15, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
<= 3.2.37
May 15, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link vulnerability
<= 3.2.36
May 10, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
<= 3.2.34
May 1, 2024
Authenticated Server-Side Request Forgery (SSRF) vulnerability
<= 3.1.26
Apr 11, 2024
Contributor+ Stored XSS vulnerability
< 3.2.26
Apr 5, 2024
Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown and CountUp Widget vulnerability
<= 3.2.31
Apr 4, 2024
Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings vulnerability
<= 3.2.17
Apr 3, 2024
Server Side Request Forgery (SSRF) vulnerability
<= 3.2.25
Mar 29, 2024
Server Side Request Forgery (SSRF) vulnerability
<= 3.2.19
Mar 26, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget vulnerability
<= 3.2.25
Mar 22, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
<= 3.2.23
Mar 14, 2024
Unauthenticated Arbitrary File Upload vulnerability
<= 3.1.10
Aug 9, 2023