CVE-2026-18435 is a stored cross-site scripting vulnerability (CWE-79) in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin. The flaw exists in the handling of the 'toggleIcon' block attribute, where input is not properly sanitized or escaped before being stored and rendered. This allows authenticated attackers with contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all plugin versions up to and including 3.7.8.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the infected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, but it compromises the integrity and confidentiality of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable 'toggleIcon' block if possible. Monitor official vendor channels for updates and apply patches promptly once released.