The Kadence Blocks plugin for WordPress contains a stored XSS vulnerability (CWE-79) via the 'redirectURL' parameter. This flaw allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts into pages. The vulnerability arises from insufficient input sanitization and output escaping, enabling script execution when the injected page is accessed. The issue affects all versions up to and including 3.5.10. No known exploits in the wild have been reported, and no patch or official fix has been documented yet.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject persistent malicious scripts into pages. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking, privilege escalation, or other attacks impacting confidentiality and integrity. The vulnerability does not affect availability. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Consider implementing additional input validation or output escaping at the application level if feasible. Monitor official channels from stellarwp for updates and apply patches promptly once released.