Technical impact
The flaw is an Improper Neutralization of Input During Web Page Generation that can lead to Stored Cross‑Site Scripting attacks. An attacker can inject malicious JavaScript into a Gutenberg Block that is stored in the database and later executed in the browsers of all site visitors when the page renders, potentially compromising credentials or enabling phishing. The weakness is described by CWE‑79, which denotes reflected or stored HTML injection vulnerabilities.
Affected Systems
Liquid Web and StellarWP provide the Gutenberg Blocks by Kadence Blocks plugin. All installations of this plugin from the initial version until and including 3.8.0.1 are vulnerable. The issue does not affect versions newer than 3.8.0.1.
Risk and Exploitability
The CVSS score of 6.5 indicates a medium severity impact. The EPSS score is not available, so there is no public estimate of exploitation frequency, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with access to the WordPress admin interface creating or editing blocks, injecting malicious code that persists in the block content; the code then runs in the browser of any visitor rendering the page.
