CVE-2026-104762

Name of the Vulnerable Software and Affected Versions Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.13

Description Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting. This occurs via the Block Font Family Attribute, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. This issue is only triggered when the site option kadence blocks font settings['load fonts local'] (Load Google Fonts Locally) is enabled.

Recommendations Update to a version newer than 3.7.12. Disable the kadence blocks font settings['load fonts local'] option to mitigate the risk.