Live › vulnerability › CVE-2026-109933
Go to dashboardThe Otter Blocks WordPress plugin before 3.2.8 writes user-supplied block styling values into an inline stylesheet without sanitizing or escaping them. A contributor-level user can store a script that runs in the browser of any visitor, including administrators, when they view the affected post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Otter Blocks plugin before 3.2.8 that let contributor-level or higher users create or edit posts. The exposure depends on those accounts being able to write block styling, so single-author sites with no untrusted writers are at lower risk. Sites that do not run the plugin can skip it.
No product ranges from the sources yet.
wp plugin get otter-blocks --field=version; versions below 3.2.8 are affected.3.2.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
This page as .md · .json · in your agent: get_signal("CVE-2026-109933")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.