The Kadence Blocks plugin allows stored cross‑site scripting through the redirectURL parameter because the input is not properly sanitized or escaped. An authenticated attacker with Contributor or higher role can inject arbitrary JavaScript that will execute whenever a visitor loads the affected page, potentially allowing data theft, session hijacking, or defacement of the site.

WordPress sites running the Kadence Blocks – Page Builder Toolkit for Gutenberg Editor, for any version up to and including 3.5.10. This includes all installations that have incorporated the plugin into their page or block architecture.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires that the attacker be authenticated with at least Contributor privileges and that they are able to inject script via the redirectURL field, which then persists in the site’s content and is served to other visitors.