Kadence Blocks, a WordPress Gutenberg editor plugin, contains a stored cross‑site scripting flaw in the toggleIcon block attribute because inputs are not properly sanitized or escaped. An attacker with contributor‑level or higher rights can insert malicious scripts that will run whenever the affected page is viewed, enabling arbitrary script execution. This weakness is categorized as CWE‑79.

WordPress sites running Kadence Blocks version 3.7.8 or earlier, including all previous releases, are affected.

The CVSS score of 6.4 indicates moderate severity, while the EPSS less than 1% suggests a low likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Because only authenticated contributors or higher can exploit it, the likely attack vector is an insider or attacker who has compromised contributor credentials; this inference is based on the requirement for authenticated access. With the low exploitation probability, the risk remains significant for sites that rely on the page builder.