Jetpack protect – threat

Hello @criscp

To report security issues, you can view Kadence’s security disclosure. However, the Jetpack warning mentions an issue that was corrected in Kadence Blocks v3.2.35. Please be sure to update to the newest version of Kadence Blocks to avoid the threat. Unfortunately, it sometimes takes a while for third-party plugins to update their databases.

I sent this to the Kadence team last week. To date, there is not a fix that addresses all the issues.While the finding states <= to 3.2.34 it also states that there is no known fix. Version 3.2.35 and beyond have yet to address the issues. I know 3.2.36 added some sanitization updates, but until the “No known fix” statement is updated, the WP scanners will continue to identify this as a vulnerability.

Here is information showing that the vulnerability was patched.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kadence-blocks/gutenberg-blocks-by-kadence-blocks-page-builder-features-3234-authenticated-contributor-stored-cross-site-scripting

As I mentioned, it can take some time for third-party plugins to update their databases.

Hi, @criscp

This vulnerability has been marked as patched. I’ll proceed to mark this topic as resolved.

If you have further questions or need additional assistance, feel free to start a new topic.

Regards,
Karla