CVE-2025-5678
📋 TL;DR
This stored XSS vulnerability in the Kadence Blocks WordPress plugin allows authenticated attackers with Contributor access or higher to inject malicious scripts via the 'redirectURL' parameter. The scripts execute when users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Gutenberg Blocks with AI by Kadence WP – Page Builder Features
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor accounts inject malicious scripts to steal user session cookies or redirect visitors to phishing pages.
If Mitigated
With proper input validation and output escaping, the vulnerability would be prevented entirely.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has Contributor credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.11 or later
Vendor Advisory: https://wordpress.org/plugins/kadence-blocks/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Kadence Blocks' and click 'Update Now'. 4. Verify version is 3.5.11 or higher.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate Kadence Blocks plugin until patched
wp plugin deactivate kadence-blocks
Restrict user roles
allRemove Contributor role access or implement strict role-based access control
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in redirectURL parameter
- Regularly audit user accounts and remove unnecessary Contributor-level access
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Kadence Blocks version. If version is 3.5.10 or lower, system is vulnerable.Check Version:
wp plugin get kadence-blocks --field=versionVerify Fix Applied:
After update, confirm version is 3.5.11 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to admin-ajax.php with redirectURL parameter containing script tags
- Multiple failed login attempts followed by successful Contributor login
Network Indicators:
- Outbound connections to suspicious domains from WordPress server
- Unexpected redirects from WordPress pages
SIEM Query:
source="wordpress.log" AND ("redirectURL" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload="))🔗 References
- https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.8/includes/assets/js/kb-countdown.min.js
- https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.8/includes/blocks/class-kadence-blocks-countdown-block.php#L605
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fc712f6b-f11b-4731-8f89-0044830400d6?source=cve
