CVE-2026-109936
Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
Unknown Otter Blocks
CVSS
7.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.2.8Otter BlocksCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
Text from CVE List
Affected versions 1
- Otter Blocksaffected: all versions before 3.2.8CVE List