CVE-2026-109933
CVE-2026-109933 · Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
CVSS 6.8 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
otter blocks
- Versions
- ≥ 0, < 3.2.8: Affected (semver)
Update to 3.2.8