CVE-2025-1291 Overview
CVE-2025-1291 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress. The flaw affects all versions up to and including 3.4.9. The plugin fails to sanitize input and escape output for the icon parameter in the testimonial block. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript that executes when visitors load the affected page. The issue is tracked under CWE-79.
Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that run in the browser context of any visitor, enabling session theft, administrator account takeover, and drive-by redirects.
Affected Products
- Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress plugin)
- All versions up to and including 3.4.9
- WordPress sites permitting Contributor-level registrations or higher
Discovery Timeline
- 2025-03-01 - CVE-2025-1291 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1291
Vulnerability Analysis
The vulnerability resides in the Kadence Blocks testimonial block handler. The plugin accepts an icon attribute supplied through the block editor and renders it back into page HTML without sufficient sanitization or output escaping. Because Contributor accounts can create draft posts containing custom block attributes, an attacker can supply a crafted icon value that breaks out of the intended attribute context and injects arbitrary script tags or event handlers. The payload is stored in the post record and executes each time a reader, editor, or administrator views the page.
Root Cause
The root cause is missing input validation and output escaping when the testimonial block renders the icon attribute. See the vulnerable render logic referenced in the WordPress Plugin Code Snippet. The plugin trusts editor-supplied block attributes and passes them into the page markup without applying WordPress escaping helpers such as esc_attr() or an allowlist of valid icon identifiers.
Attack Vector
Exploitation requires an authenticated account with at least Contributor privileges. The attacker creates or edits a post containing a Kadence testimonial block and supplies a malicious value in the icon field. Once the post is previewed, submitted for review, or published, any user who loads the rendered page executes the injected script. This creates a cross-context attack path where a low-privilege author can escalate by hijacking an administrator session. Technical details are summarized in the Wordfence Vulnerability Report.
No verified proof-of-concept code has been published. The vulnerability class is stored XSS where an unsafe attribute value is echoed into DOM markup by the plugin's PHP render callback.
Detection Methods for CVE-2025-1291
Indicators of Compromise
- Post content containing Kadence testimonial blocks with icon attribute values that include <script>, onerror=, onload=, or javascript: substrings.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that embed Kadence blocks.
- Newly created Contributor accounts followed by rapid submission of posts using Kadence blocks.
Detection Strategies
- Query the WordPress wp_posts table for post_content matching the testimonial block signature combined with HTML event handlers or angle brackets in the icon parameter.
- Deploy a web application firewall rule that inspects saved post payloads for script markup inside Kadence block JSON attributes.
- Review audit logs for Contributor and Author role activity that includes creation or modification of pages containing Kadence blocks.
Monitoring Recommendations
- Alert on privileged users (Editor, Administrator) viewing pages authored by Contributors that contain Kadence blocks prior to review.
- Monitor browser Content Security Policy (CSP) violation reports for inline script executions originating from post pages.
- Track plugin file integrity and version reporting to confirm affected sites are running versions above 3.4.9.
How to Mitigate CVE-2025-1291
Immediate Actions Required
- Update the Kadence Blocks plugin to the version released after 3.4.9 that includes the fix from WordPress Changeset #3246675.
- Audit existing Kadence testimonial blocks across all posts and pages for suspicious icon attribute content and remove any injected markup.
- Review Contributor, Author, and Editor accounts for unexpected registrations and rotate credentials for accounts that show anomalous activity.
Patch Information
The plugin maintainers addressed the flaw by adding proper sanitization and escaping to the testimonial block render path. Site administrators should install the patched release from the WordPress plugin repository and confirm the deployed version is greater than 3.4.9. Refer to the WordPress Changeset #3246675 for the exact code change.
Workarounds
- Restrict Contributor and Author role assignments and disable open user registration until the plugin is patched.
- Deploy a Content Security Policy that blocks inline scripts and unauthorized external script sources on public-facing pages.
- Require editorial review of all posts containing Kadence blocks before they are published or previewed by higher-privileged users.
# Configuration example: update the plugin via WP-CLI
wp plugin update kadence-blocks
wp plugin get kadence-blocks --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
