E1En

**Name of the Vulnerable Software and Affected Versions** Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.6 **Description** The plugin is subject to sensitive information exposure through the `editor assets variables`. Authenticated attackers with contributor-level access or higher can extract the connected Kadence account license key, license owner email, `api key`, `api email`, and license domain. This is achieved by inspecting `window.kadence blocks params.proData` within the browser console. The issue occurs if an administrator has previously connected a valid Kadence license, allowing the credential bundle to be read from the block editor client context without requiring server-side request manipulation. **Recommendations** Update to a version newer than 3.7.5.