Kadence Blocks <=3.7.5 Authenticated Sensitive Information Exposure (CVE-2026-11357) Advisory

Vulnerability Overview Vulnerability Name: Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization CVE ID: CVE-2026-11357 CVSS Score: 4.3 (Medium) Release Date: June 17, 2026 Last Updated: June 18, 2026 Researcher: se1en Affected Products Affected Software: Kadence Blocks – Page Builder Toolkit for Gutenberg Editor Affected Versions: <= 3.7.5 Fixed Version: 3.7.6 Software Type: Plugin Software Slug: kadence-blocks Remediation Recommendation: Update to version 3.7.6 or later Vulnerability Description The Kadence Blocks – Page Builder Toolkit for Gutenberg Editor plugin is vulnerable to sensitive information exposure in versions 3.7.5 and earlier. This vulnerability allows authenticated attackers (Contributor level and above) to extract site-connected Kadence account keys, license owner emails, application keys, application emails, and license domains by inspecting in the browser console. Exploitation requires only that the administrator has previously connected a valid Kadence license; the full credential package can subsequently be read by any attacker at the Contributor level from the block editor client context, without any server-side requests. References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material. Copyright: - 2012-2026 Defiant Inc. - 1999-2026 The MITRE Corporation Contact Us Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Other Resources Wordfence Intelligence: Offers free personal and commercial API access, as well as free webhook integration. Documentation: Provides documentation on how to access and use the vulnerability database API. Footer Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales Statement: Do Not Sell or Share My Personal Information Social Media Links Twitter: X Facebook: f LinkedIn: in Instagram: O Product Links Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Central: Wordfence Central Support Links Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Links Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About Links About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscription Links Stay Updated: Sign up for news and updates from our panel of experienced security professionals. Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Cherubic: Cherubic --- Note: No POC code or exploitation code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Kadence Blocks <=3.7.5 Authenticated Sensitive Information Exposure (CVE-2026-11357) Advisory