The Kadence Blocks plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with editor or higher privileges can inject arbitrary scripts via the contact form message settings. These scripts execute when any user accesses the compromised page. The vulnerability affects all versions up to 3.2.17 and is particularly relevant for multi-site setups or installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated editor-level user to inject and execute arbitrary JavaScript in the context of the affected site. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The vulnerability primarily affects multi-site WordPress installations or those with restricted HTML filtering, increasing the risk surface in those environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only. Consider temporarily disabling or limiting the use of the contact form message settings in Kadence Blocks. Monitor vendor channels for updates and apply patches promptly once released.