# Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lottie Animation Expressions

- **ID:** WPSEC-2026-1907
- **Plugin:** Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (`kadence-blocks`), https://wordpress.org/plugins/kadence-blocks/
- **Affected versions:** all versions before 3.8.1
- **Fixed in:** 3.8.1 (Update to 3.8.1 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kadence-blocks
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1907/

## Description

The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lottie animation expressions in all versions up to, and including, 3.8.0.2, due to insufficient validation of animation sources and insufficient sanitization of animation data. The Lottie block renders any URL set in its fileUrl attribute, and the bundled player evaluates expressions embedded in Lottie JSON as JavaScript. Animations uploaded through the plugin's REST route, which any user with the publish_posts capability could use, were also stored and served unchanged. This makes it possible for authenticated attackers, with contributor-level access and above, to point a Lottie block at a crafted animation that runs arbitrary web scripts in the site's context whenever a user accesses the injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1907/
- https://plugins.svn.wordpress.org/kadence-blocks/tags/3.8.1/
- https://wordpress.org/plugins/kadence-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1907/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.