The Kadence Blocks plugin for WordPress, specifically the Gutenberg Blocks with AI by Kadence WP – Page Builder Features component, suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'titleFont' parameter. This vulnerability allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code into pages, which executes when those pages are accessed by others. The root cause is insufficient input sanitization and output escaping of this parameter in all versions up to 3.2.38. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. There is no indication of an official patch or vendor advisory at this time, and no known exploits have been reported.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages, potentially leading to unauthorized actions or data exposure when other users view the compromised content. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability is stored XSS, it can persist and affect multiple users accessing the injected pages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider applying manual input validation or sanitization controls if feasible. Monitor official channels from stellarwp for updates or patches addressing this vulnerability.