The Kadence Blocks plugin for WordPress, specifically the Gutenberg Blocks with AI by Kadence WP – Page Builder Features, suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-12304. This vulnerability arises from improper neutralization of input during web page generation, allowing authenticated users with Contributor-level permissions or higher to inject malicious scripts via the button block link. These scripts execute whenever any user accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The issue affects all versions up to 3.4.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An authenticated attacker with Contributor-level access or higher can inject malicious scripts into pages via the button block link. These scripts execute in the context of users who view the infected pages, potentially allowing theft of user data or session tokens. The vulnerability does not impact system availability. The CVSS score of 6.4 reflects a medium severity with partial confidentiality and integrity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the button block link feature in Kadence Blocks. Monitor for updates from stellarwp regarding a security patch and apply it promptly once available.