Kadence Blocks < 3.7.8.2 - Contributor+ Stored XSS via Identity Block Inner Image Content

Description

The plugin is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block's urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached.