CVE-2026-103354: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks

CVE-2026-103354 is a stored cross-site scripting vulnerability in the Gutenberg Blocks by Kadence Blocks plugin for WordPress, maintained by Liquid Web / StellarWP. The flaw is due to improper neutralization of input during web page generation, which allows attackers to store malicious scripts that execute when viewed by other users. This vulnerability affects all versions from the initial release through 3.7.11.1. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impact on confidentiality, integrity, and availability. No vendor patch or mitigation information is provided in the source data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, and it can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected plugin versions. Monitor vendor channels for updates and apply patches promptly once released.