CVE-2026-109933

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109933

The Otter Blocks WordPress plugin, in versions prior to 3.2.8 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization and escaping of user-supplied block styling values before they are written into an inline stylesheet . This allows users with ...

EUVD-2026-108586

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

PT-2026-121759

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...