License credential disclosure via caller-selected library host

Sensitive data exposure in Nexcess Kadence Blocks 3.7.8 and earlier allows remote authenticated users to disclose stored license credentials. The prebuilt design-library AJAX handlers accept a caller-selected base URL, then append the site's stored Kadence license email and key to template requests without first restricting the destination to a trusted Kadence host. Contributor access, an editor nonce, and a licensed site with stored credentials are required; the demonstrated consequence is disclosure of those credentials to an attacker-controlled host.