CVE-2025-5678 Overview
The Kadence WP Gutenberg Blocks with AI plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the redirectURL parameter. The flaw affects all versions up to and including 3.5.10 and stems from insufficient input sanitization and output escaping. Authenticated attackers holding Contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page, enabling session theft, forced redirects, or defacement within the victim's authenticated context.
Critical Impact
Authenticated Contributor accounts can persist malicious JavaScript in WordPress pages, executing in the browser of every visitor including administrators.
Affected Products
- Kadence WP Gutenberg Blocks with AI plugin for WordPress
- All versions up to and including 3.5.10
- WordPress sites permitting Contributor-level registration or higher
Discovery Timeline
- 2025-07-09 - CVE-2025-5678 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5678
Vulnerability Analysis
The vulnerability resides in the Kadence Countdown block, specifically in how the plugin handles the redirectURL attribute. The class-kadence-blocks-countdown-block.php file renders block attributes into page markup without applying adequate escaping routines. WordPress provides helper functions such as esc_url() and esc_attr() for sanitizing URL and attribute contexts, but the plugin fails to apply them consistently to the redirectURL value.
Because the attribute is stored in the post content and rendered on the front end, the payload persists across sessions. Any visitor loading a page containing the affected block executes the attacker-supplied script. A Contributor account can prepare content containing the malicious block. When an editor or administrator previews or publishes the post, the payload runs in their authenticated session, enabling account takeover through cookie exfiltration or forged administrative requests.
Root Cause
The root cause is missing output encoding on user-controlled block attributes. The redirectURL field is treated as a trusted string during template rendering rather than as untrusted input requiring context-aware escaping. This falls under CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation requires an authenticated session with Contributor privileges or higher. The attacker inserts a Kadence Countdown block into a post and supplies a JavaScript payload through the redirectURL attribute. User interaction, such as viewing the rendered page, triggers script execution. The scope change permits impact on components beyond the vulnerable plugin, including the WordPress administrative interface.
See the WordPress Kadence Countdown Block Class source reference for the affected rendering code path.
Detection Methods for CVE-2025-5678
Indicators of Compromise
- Post or page revisions authored by low-privilege users containing Kadence Countdown blocks with redirectURL values that include <script>, javascript:, or event handlers such as onerror=.
- Outbound requests from editor or administrator browsers to unfamiliar domains shortly after visiting plugin-rendered pages.
- Unexpected creation of administrator accounts or modifications to WordPress user roles following content publication.
Detection Strategies
- Audit the wp_posts table for serialized Kadence block attributes containing redirectURL values with script-like tokens or encoded payloads.
- Deploy a Web Application Firewall (WAF) rule that flags POST requests to /wp-json/wp/v2/ and /wp-admin/post.php carrying redirectURL values with HTML or JavaScript syntax.
- Review WordPress activity logs for Contributor-role edits to pages that use countdown blocks.
Monitoring Recommendations
- Monitor plugin version telemetry across WordPress inventory and flag hosts running Kadence Blocks 3.5.10 or earlier.
- Enable Content Security Policy (CSP) reporting to capture inline script violations originating from post content.
- Alert on privilege changes and new administrator sessions correlated with recent content authoring events.
How to Mitigate CVE-2025-5678
Immediate Actions Required
- Update the Kadence Gutenberg Blocks with AI plugin to a version later than 3.5.10 on all WordPress instances.
- Review recent posts and pages authored by Contributor-level accounts for suspicious redirectURL values and remove any malicious blocks.
- Rotate credentials and session tokens for administrator accounts that may have previewed affected content.
Patch Information
Refer to the Wordfence Vulnerability Summary for the fixed release information. Upgrade through the WordPress plugin dashboard or by replacing the plugin directory with the patched version obtained from the official WordPress plugin repository.
Workarounds
- Restrict Contributor registration and limit block-editing permissions to trusted users until the plugin is updated.
- Disable the Kadence Countdown block using the Block Manager if patching cannot occur immediately.
- Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
# Update Kadence Blocks via WP-CLI
wp plugin update kadence-blocks
# Verify installed version is above 3.5.10
wp plugin get kadence-blocks --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
