CVE-2026-18062

This stored XSS in Kadence Blocks (CVE-2026-18062) targets the Identity Block's inner image content and requires contributor-level access to exploit. The vulnerability stems from a code path labeled urlTransparent that bypasses normal sanitization - developers recognized direct URL handling needed special treatment but only partially secured the bypass. This is incomplete threat modeling, not reckless prioritization. Treating contributor access as a severity constraint is increasingly outdated. Modern WordPress workflows grant contributor access to content creators, marketing teams, guest authors, and agency collaborators - it's no longer a trusted insider role. More critically, stored XSS executes against every visitor to affected pages, not just authenticated users. The CVSS score obscures this public-facing blast radius: a contributor injects the payload, but the attack impacts everyone who views the page. This vulnerability is not isolated. The pattern of sanitization bypasses for feature compatibility in Gutenberg blocks has appeared in 2016, 2018, 2020, and now 2026. The root cause isn't skills gaps - it's institutional memory that doesn't reach developers under release pressure. Every plugin building custom Gutenberg blocks carries this risk because the framework normalized treating 'inner content' as implicitly trusted. Check your Kadence Blocks installation for the urlTransparent conditional in block rendering code. Audit any reusable templates or pre-built layouts - if this vulnerability exists in a foundational block, it amplifies across every template instance. Consider contributor accounts as effectively privileged by design in page builder contexts, not as a meaningful security boundary. Patch promptly when available and monitor for unusual script injection in page content.

Reviewed through automated stages and approved by a human before publication.