Wordpress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via titleFont Parameter vulnerability discovered by stealthcopter in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.38...

CVE-2024-4863: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for...