Kadence Blocks, a WordPress block plugin, contains a stored cross‑site scripting flaw in the font‑family attribute for all versions up to 3.7.12. Because the plugin fails to properly sanitize or escape user input, an attacker with author or higher privileges can inject arbitrary JavaScript into the page. When the injected scripts execute they run in the browser context of any visitor who loads the affected page, allowing the attacker to steal session cookies, deface content, or perform other malicious actions. The vulnerability is limited to situations where the "Load Google Fonts Locally" option is enabled, which is an additional configuration setting not enabled by default.

The flaw applies only to the Kadence Blocks plugin for WordPress, specifically versions 3.7.12 and earlier. This includes all installations using this plugin on any WordPress site where the plugin is active.

The CVSS score of 6.4 rates the vulnerability as medium severity, and the EPSS score is not available, indicating unknown exploitation probability. The flaw is not listed in CISA's KEV catalog. Exploitation requires an authenticated author‑level user and the additional setting to be enabled, making it a privileged XSS scenario. Attackers would need to log into the WordPress backend to insert malicious font‑family code, after which any site visitor would be affected. Given these conditions, the risk is moderate but can have serious impact on privileged users and site visitors if the plugin is not patched or misconfiguration remains.