The Kadence Blocks plugin for WordPress contains a stored XSS vulnerability (CWE-79) caused by improper neutralization of input during web page generation. This allows authenticated attackers with contributor or higher privileges to inject malicious scripts via multiple parameters. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 3.2.34. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor or higher privileges can inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to unauthorized actions performed in the context of the victim user, including data theft or manipulation. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider additional input validation or output escaping controls if possible. Monitor official vendor channels for updates and apply patches promptly once released.