The Kadence Blocks plugin allows an authenticated user with Contributor or higher role to supply arbitrary content to the 'icon' field of testimonial blocks. The input is not sanitized or escaped before being stored and rendered, enabling stored XSS. A malicious actor could embed scripts that run in the browser context of any visitor to the affected page, potentially stealing session cookies, defacing content, or redirecting users to phishing sites.

WordPress sites running the Kadence Blocks – Page Builder Toolkit for Gutenberg Editor plugin version 3.4.9 and earlier. Any site that has the testimonial block feature enabled and that permits contributors or higher roles to edit blocks is vulnerable.

The CVSS score of 6.4 indicates moderate severity, but the vulnerability requires authentication and a specific block type, reducing rapid public exploitation. EPSS < 1% suggests low exploitation probability, and the issue is not listed in the CISA KEV. Attackers would need valid contributor credentials, then add malicious code to a testimonial block; the script would execute whenever any user views the page containing that block.