CVE-2026-105890: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks

This vulnerability involves improper neutralization of input in the Gutenberg Blocks by Kadence Blocks plugin, allowing stored cross-site scripting (XSS). The flaw exists in versions from the initial release through 3.7.12, enabling an attacker with limited privileges and requiring user interaction to inject malicious scripts that may impact confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges and user interaction.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to stored XSS. An attacker could execute arbitrary scripts in the context of the affected site, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires privileges and user interaction, limiting the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply any recommended temporary mitigations from the vendor and restrict privileges to trusted users. Monitor for updates from Liquid Web / StellarWP regarding patches for this vulnerability.