CVE-2026-109937 Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...

CVE-2026-109937

The Otter Blocks WordPress plugin (versions before 3.2.3 ) is vulnerable to an unauthenticated open redirect . The root cause is a failure to validate that a user-supplied return URL belongs to the site when building the return destination for a Stripe Checkout session . This allows an attacker t...

CVE-2026-109937 Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...