CVE-2026-110510 Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-110510 Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-109936 Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allow...

CVE-2026-109936

The Otter Blocks WordPress plugin (versions before 3.2.8 ) contains an unauthenticated stored Cross-Site Scripting (XSS) vulnerability. The root cause is an improperly bounded pattern used to rewrite dynamic-content tokens during block rendering. This allows an attacker to consume the closing quo...

CVE-2026-111737

The Speed Optimizer WordPress plugin in versions before 7.8.5 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape specific settings before they are outputted in the head section of front-end pages. This flaw allows high-privile...

EUVD-2026-108589

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allow...

EUVD-2026-108592

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-110510

The Essential Addons for Elementor WordPress plugin (versions before 6.8.7 ) contains a content injection vulnerability. The plugin fails to validate the HTML tag setting of certain widgets during markup generation. This allows users with author privileges or higher to inject iframe and form elem...

EUVD-2026-108590

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109934 Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protecte...

CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109935 Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author...

CVE-2026-109934 Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protecte...

CVE-2026-109934

The Otter Blocks WordPress plugin (versions 3.1.1-3.2.7 ) is vulnerable to an unauthenticated non-public content disclosure via a REST API endpoint. The root cause is the plugin's failure to correctly determine if a post is publicly readable, as it incorrectly treats any post with a

EUVD-2026-108586

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

EUVD-2026-108588

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author...

EUVD-2026-108587

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protecte...

CVE-2026-109935

The Otter Blocks WordPress plugin, in versions prior to 3.2.8 , fails to enforce block visibility conditions when a published post is rendered via the WordPress REST API . This flaw allows unauthenticated users to access restricted block content. Specifically, content intended to be visible only ...

CVE-2026-109933

The Otter Blocks WordPress plugin, in versions prior to 3.2.8 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization and escaping of user-supplied block styling values before they are written into an inline stylesheet . This allows users with ...