CVE-2026-18435: Kadence Blocks WordPress Plugin XSS Flaw

CVE-2026-18435 Overview

CVE-2026-18435 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress. The flaw affects all versions up to and including 3.7.8. The vulnerability exists in the toggleIcon block attribute of the Table of Contents block due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes when any user views the affected page.

Critical Impact
Authenticated contributors can persist malicious scripts in WordPress content, enabling session theft, credential harvesting, and administrative account takeover when higher-privileged users visit injected pages.

Affected Products

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (WordPress plugin)
All versions up to and including 3.7.8
WordPress installations with contributor-level or higher user accounts

Discovery Timeline

2026-08-01 - CVE-2026-18435 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18435

Vulnerability Analysis

The vulnerability resides in the Table of Contents block implementation within Kadence Blocks. The plugin accepts a toggleIcon block attribute from users but fails to properly sanitize the input on save and does not escape the value on output. When the block renders on the frontend, the attacker-controlled string is emitted into the page HTML without contextual encoding.

Because block attributes are stored in post content, the injected payload persists across page loads. Any visitor rendering the page—including administrators previewing content—executes the attacker's JavaScript in their browser session. The vulnerable code paths reside in class-kadence-blocks-table-of-contents-block.php at line 293 and class-kadence-blocks-table-of-contents.php at line 936. Review the WordPress plugin source for the affected implementation.

Root Cause

The root cause is missing input sanitization and output escaping on the toggleIcon attribute. WordPress provides functions such as sanitize_text_field(), esc_attr(), and esc_html() for these purposes, but the vulnerable code path emits the attribute value directly into rendered HTML. This breaks WordPress security best practices for handling user-supplied block attributes.

Attack Vector

An attacker requires an authenticated WordPress account with contributor privileges or higher. The attacker creates or edits a post containing a Kadence Table of Contents block and manipulates the toggleIcon attribute to include an XSS payload. Once the post is saved and viewed, the script executes in the victim's browser context. The scope change (S:C) reflects that code executes in the WordPress site origin, affecting other users beyond the attacker. Details are documented in the Wordfence Vulnerability Report.

The vulnerability manifests when the toggleIcon value is rendered without escaping. See the security advisory linked above for technical details on the payload structure and affected code paths.

Detection Methods for CVE-2026-18435

Indicators of Compromise

Post content containing Kadence Table of Contents blocks with unusual toggleIcon attribute values, especially strings containing <script>, onerror=, javascript:, or HTML event handlers.
Unexpected outbound requests from browsers viewing WordPress pages, indicating exfiltration of cookies or session tokens.
Newly created administrator accounts or privilege escalations from contributor-level accounts following block edits.
Modifications to wp_posts entries by contributor-role users that include encoded or obfuscated JavaScript in block attributes.

Detection Strategies

Audit WordPress post revisions and wp_posts content for Kadence blocks containing HTML tags, event handlers, or protocol handlers within toggleIcon attribute values.
Deploy a Web Application Firewall (WAF) rule to block requests to wp-admin/post.php and the REST API endpoint /wp-json/wp/v2/posts where block payloads contain script tags.
Enable WordPress activity logging to correlate contributor-level post edits with subsequent administrator session anomalies.
Scan installed plugins for Kadence Blocks versions at or below 3.7.8 using plugin inventory tools or the WordPress CLI command wp plugin list.

Monitoring Recommendations

Monitor authentication logs for administrator sessions immediately following contributor post publications.
Alert on Content Security Policy (CSP) violations reported by browsers viewing WordPress pages.
Track anomalous outbound network connections from workstations used by WordPress administrators.
Baseline and monitor wp_posts post_content sizes and block attribute lengths for unexpected growth.

How to Mitigate CVE-2026-18435

Immediate Actions Required

Update Kadence Blocks to the version released after 3.7.8 that addresses this vulnerability. Reference the WordPress plugin changeset for the fix.
Audit contributor and author accounts and remove or downgrade any that are inactive or unnecessary.
Review existing posts and pages for Kadence Table of Contents blocks containing suspicious toggleIcon values and sanitize or remove them.
Rotate administrator credentials and invalidate active WordPress sessions if compromise is suspected.

Patch Information

The plugin vendor released a patch addressing the missing sanitization on the toggleIcon attribute. The fix is committed in the WordPress plugin repository changeset. Administrators should upgrade to the latest available Kadence Blocks release through the WordPress plugin dashboard or via wp plugin update kadence-blocks.

Workarounds

Restrict contributor-level and above accounts to trusted users only until the patch is applied.
Deploy a WAF rule blocking block attribute payloads containing <script, onerror=, onload=, or javascript: in POST requests to WordPress editor endpoints.
Implement a strict Content Security Policy that disallows inline scripts on WordPress-rendered pages to reduce XSS impact.
Temporarily disable the Kadence Table of Contents block through the WordPress block editor settings if the block is not required.

bash

# Update Kadence Blocks via WP-CLI
wp plugin update kadence-blocks

# Verify installed version
wp plugin get kadence-blocks --field=version

# Audit posts for suspicious toggleIcon attributes
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%toggleIcon%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"