CVE-2026-18062 Overview
CVE-2026-18062 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress. The flaw exists in all versions up to and including 3.7.8.1. It resides in the Identity Block's inner image content handling, where insufficient input sanitization and output escaping in the build_html() function allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Exploitation requires the block's urlTransparent attribute to be set to a non-empty value, which is a precondition for reaching the vulnerable code path. Injected scripts execute in the browser of any user viewing an affected page. The issue is categorized under [CWE-79].
Critical Impact
Authenticated contributors can persist malicious JavaScript into WordPress pages, enabling session theft, account takeover, and privilege escalation when higher-privileged users view the injected content.
Affected Products
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress
- All plugin versions up to and including 3.7.8.1
- WordPress sites permitting contributor-or-higher accounts with access to the Identity Block
Discovery Timeline
- 2026-08-01 - CVE-2026-18062 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18062
Vulnerability Analysis
The vulnerability lives in class-kadence-blocks-identity-block.php, specifically inside the build_html() server-side rendering logic. When the Identity Block renders its inner image content, attacker-controlled attributes flow into the generated HTML without adequate sanitization or output escaping. Because the content is stored inside post/page block markup, the payload persists across page loads and executes for every subsequent viewer. Authenticated contributors are permitted to author block content in WordPress, giving them a legitimate write path to the vulnerable attribute. Once a higher-privileged user, such as an editor or administrator, previews or opens the affected page, the injected script runs in that user's session context. This creates opportunities for cookie theft, forced administrative actions, and pivoting to full site compromise.
Root Cause
The root cause is missing input sanitization on incoming block attributes and missing output escaping when the Identity Block emits inner image markup. WordPress provides functions such as esc_attr(), esc_url(), and wp_kses_post() for this purpose, but the vulnerable code path in build_html() did not consistently apply them to Identity Block attributes before rendering.
Attack Vector
A remote, authenticated attacker with at least contributor privileges submits a crafted Identity Block containing a malicious payload in the inner image content, while ensuring the urlTransparent attribute is set to a non-empty value to reach the vulnerable branch. The payload is stored in the post's block content. When any user, including administrators, visits the page, the stored script executes in their browser. Because the CVSS scope is Changed, impact can extend beyond the vulnerable component to the wider WordPress site and its users. See the Wordfence Vulnerability Analysis and the Kadence Blocks Changeset for technical specifics.
Detection Methods for CVE-2026-18062
Indicators of Compromise
- Identity Block instances with a populated urlTransparent attribute combined with unusual characters such as <script>, onerror=, onload=, or javascript: in inner image content fields.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages built with Kadence Blocks.
- New or modified posts and pages authored by contributor-level accounts that embed Identity Blocks.
Detection Strategies
- Query the wp_posts table for post_content entries containing kadence/identity block markup with suspicious attribute values.
- Review Kadence Blocks plugin version across all WordPress sites; any version at or below 3.7.8.1 is vulnerable.
- Correlate contributor-level content submissions with subsequent script execution events observed in browser telemetry or web application firewall (WAF) logs.
Monitoring Recommendations
- Enable WordPress audit logging to track block edits, user role changes, and content submissions by low-privileged accounts.
- Monitor WAF alerts for stored XSS signatures targeting block editor endpoints such as /wp-json/wp/v2/pages and /wp-json/wp/v2/posts.
- Alert on administrative session activity that follows a contributor's page publication, which may indicate stored XSS triggering under an admin context.
How to Mitigate CVE-2026-18062
Immediate Actions Required
- Update the Kadence Blocks plugin to a version later than 3.7.8.1 that contains the fix referenced in the Kadence Blocks Changeset.
- Audit all existing pages containing Identity Blocks and remove any suspicious script content from inner image attributes.
- Review contributor and author accounts, disabling any that are unused or unrecognized.
Patch Information
The Kadence Blocks maintainers addressed the flaw by adding sanitization and output escaping to the Identity Block rendering path. Review the patched code in the plugin repository and refer to the vendor changeset for the specific commit that resolves the missing escaping in build_html(). See the Kadence Blocks Code Snippet for the vulnerable pre-patch logic.
Workarounds
- Restrict contributor and author roles until the plugin is upgraded, using a role-management plugin to remove block-editing capabilities.
- Disable the Kadence Blocks Identity Block via the plugin's block manager if it is not required.
- Deploy a WAF rule that blocks <script> tags and event-handler attributes in REST API requests targeting Kadence block endpoints.
# Configuration example: update Kadence Blocks using WP-CLI
wp plugin update kadence-blocks --version=<fixed-version>
wp plugin get kadence-blocks --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
