CVE-2026-109937
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session. This allows unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
Risk Assessment
An attacker can use the plugin to redirect users to malicious sites after completing or canceling a payment, potentially leading to phishing or data theft. This poses a threat to user trust and transaction security.
Recommendation
Update the Otter Blocks plugin to version 3.2.3 or later. Consider monitoring for unusual redirects in the payment process.
Other vulnerabilities in Otter Blocks WordPress plugin
See all- CVE-2026-109936Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
- CVE-2026-109935Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API. This allows unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
- CVE-2026-109934Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public. This allows unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Original NVD description (English source)
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS