CVE-2026-18062

Name of the Vulnerable Software and Affected Versions Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.8.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the Identity Block Inner Image Content. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page. This issue is triggerable when the urlTransparent attribute is set to a non-empty value, allowing the execution path in the build html() function to be reached.

Recommendations Update to a version newer than 3.7.8.1. As a temporary mitigation, ensure the urlTransparent attribute is not set to a non-empty value.