Kadence Blocks < 3.7.12.1 - Author+ Stored Cross-Site Scripting via Block Font Family Attribute

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the Block Font Family attribute due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The encoding bypass is only triggered when the 'Load Google Fonts Locally' site option (kadence_blocks_font_settings load_fonts_local) is enabled, which is not the default configuration.