Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lottie Animation Expressions
- ID
- WPSEC-2026-1907
- Plugin
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (kadence-blocks)
- Affected
- all versions before 3.8.1
- Remediation
- Update to 3.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-29
- Attack surface
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor on WPSec AttackSurface
- Fix released
- Published
Description
The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lottie animation expressions in all versions up to, and including, 3.8.0.2, due to insufficient validation of animation sources and insufficient sanitization of animation data. The Lottie block renders any URL set in its fileUrl attribute, and the bundled player evaluates expressions embedded in Lottie JSON as JavaScript. Animations uploaded through the plugin's REST route, which any user with the publish_posts capability could use, were also stored and served unchanged. This makes it possible for authenticated attackers, with contributor-level access and above, to point a Lottie block at a crafted animation that runs arbitrary web scripts in the site's context whenever a user accesses the injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-1907/
- https://plugins.svn.wordpress.org/kadence-blocks/tags/3.8.1/
- https://wordpress.org/plugins/kadence-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS