Kadence Blocks EUVD-2026-96107

Two concrete prerequisites must both hold: (1) the attacker must have an authenticated WordPress account with author-level capability or higher (PR:L) on the target site; and (2) the site must have the non-default 'Load Google Fonts Locally' option enabled (kadence_blocks_font_settings['load_fonts_local']) - the encoding bypass is explicitly stated to trigger only in this configuration. Limiting factors that reduce realistic risk: the required privileged account, the non-default setting (default-configured sites are unaffected), and the need for a victim to subsequently access the injected page for payload execution. Sites running the default Kadence Blocks configuration are not exploitable via this path.

This is a moderate, conditionally-exploitable issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) describes a network-reachable stored XSS requiring only low privileges, with a scope change and low confidentiality/integrity impact. Two signals point toward lower real-world risk, however. First, PR:L is accurate but non-trivial: the attacker must already hold author-level access or above on the target site - a meaningful trust barrier, not an anonymous internet attacker. Second, and critically, the description states the encoding bypass triggers ONLY when the non-default 'Load Google Fonts Locally' option (kadence_blocks_font_settings['load_fonts_local']) is enabled - a precondition the vector's AC:L does not capture; I assess this closer to AC:H because exploitation depends on a configuration state outside the attacker's control. No EPSS score, SSVC decision, KEV listing, or POC flag was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The missing EPSS/KEV data limits probabilistic ranking, but the combination of a required privileged account plus a non-default setting points to targeted or insider-style abuse rather than mass exploitation. Net: patch on normal exposure-managed timelines, not an emergency.

On a Kadence Blocks site that has enabled the non-default 'Load Google Fonts Locally' option, an attacker holding an author-level or higher account edits a page and sets a crafted Block Font Family attribute that bypasses sanitization. When any visitor or administrator later views the page, the stored JavaScript executes in their browser session. No public exploit code was identified at time of analysis.