WordPress Plugin Vulnerabilities

Kadence Blocks < 3.7.8.1 - Contributor+ Information Exposure

Description

The plugin is vulnerable to Sensitive Information Exposure. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
kadence-blocks
Fixed in 3.7.8.1

References

CVE
CVE-2026-66696
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/adecdae5-2cb9-42f3-befb-3f5dc73ed5dc

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Abdullah Kareem "cyberkareem"
Verified
No
WPVDB ID
8f262a81-371d-4ce1-938f-b3931cf8fe62

Timeline

Publicly Published
2026-07-29 (about 26 days ago)
Added
2026-08-04 (about 19 days ago)
Last Updated
2026-08-04 (about 19 days ago)

Other

Published
Title
Published
2025-03-27
Title
Booking for Appointments and Events Calendar – Amelia < 1.2.20 - Unauthenticated Full Path Disclosure
Published
2023-12-05
Title
Ultimate Dashboard < 3.7.11 - Login Page Disclosure on Multi-site
Published
2021-09-09
Title
WordPress 5.4 to 5.8 - Data Exposure via REST API
Published
2025-12-04
Title
SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure
Published
2024-04-24
Title
Essential Addons for Elementor < 5.9.16 - Information Exposure