CVE-2026-109933
UnknownSummary
The Otter Blocks WordPress plugin before version 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet. This allows users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
Risk Assessment
This stored XSS vulnerability allows low-privileged users (contributors) to execute arbitrary JavaScript in the browsers of administrators and other visitors. It can lead to administrator session hijacking, data theft, or further privilege escalation within the WordPress site.
Recommendation
Update the Otter Blocks plugin to version 3.2.8 or later. Until patched, limit the number of users with contributor-level access and above, and consider disabling the plugin.
Other vulnerabilities in Otter Blocks
See all- CVE-2026-102002Low
The Otter Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 via the 'otter_form_widget_filter' parameter. This allows authenticated attackers with subscriber-level access and above to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count.
- CVE-2026-4945Medium
The Otter Blocks plugin for WordPress, in all versions up to and including 3.1.7, is vulnerable to Insecure Direct Object Reference in the 'watch_checkout' function due to missing validation on a user controlled key. This allows unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Original NVD description (English source)
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS