CVE-2026-18435

Name of the Vulnerable Software and Affected Versions Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.9

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the toggleIcon block attribute, which execute when a user visits the affected page.

Recommendations Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to version 3.7.9 or later.