{
 "id": "WPSEC-2026-1907",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1907/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1907/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1907/index.md",
 "title": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lottie Animation Expressions",
 "description": "The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lottie animation expressions in all versions up to, and including, 3.8.0.2, due to insufficient validation of animation sources and insufficient sanitization of animation data. The Lottie block renders any URL set in its fileUrl attribute, and the bundled player evaluates expressions embedded in Lottie JSON as JavaScript. Animations uploaded through the plugin's REST route, which any user with the publish_posts capability could use, were also stored and served unchanged. This makes it possible for authenticated attackers, with contributor-level access and above, to point a Lottie block at a crafted animation that runs arbitrary web scripts in the site's context whenever a user accesses the injected page.",
 "plugin": {
  "slug": "kadence-blocks",
  "name": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
  "full_name": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
  "wordpress_org": "https://wordpress.org/plugins/kadence-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kadence-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kadence-blocks"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.1",
 "remediation": "Update to 3.8.1 or later.",
 "fix_released": "2026-10-28T15:36:59+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:37:48.560675+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1907/",
  "https://plugins.svn.wordpress.org/kadence-blocks/tags/3.8.1/",
  "https://wordpress.org/plugins/kadence-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kadence-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-29"
 }
}