CVE-2026-104762: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

CVE-2026-104762 is a stored cross-site scripting vulnerability in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically in the Block Font Family attribute. Authenticated attackers with author-level privileges or above can inject arbitrary web scripts that execute upon page access. The vulnerability is conditional on the 'Load Google Fonts Locally' site option being enabled, which bypasses normal encoding protections. All versions up to and including 3.7.12 are affected.

An attacker with author-level access or higher can inject malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability requires authentication and specific site configuration, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should consider disabling the 'Load Google Fonts Locally' option to prevent exploitation. Restrict author-level access to trusted users only. Monitor for vendor updates addressing this vulnerability.