Live › vulnerability › CVE-2026-109936
Go to dashboardThe Otter Blocks WordPress plugin before 3.2.8 rewrites dynamic-content tokens with a pattern that can consume the closing quote of an HTML attribute, pulling adjacent unescaped data into the page as new attributes. An unauthenticated attacker can plant stored cross-site scripting that runs in the browser of any visitor to an affected page, including logged-in administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Otter Blocks WordPress plugin older than 3.2.8 that render dynamic-content blocks with adjacent unescaped data are exposed, and the attack needs no account. Sites that do not run the plugin, or run 3.2.8 or later, can skip it.
No product ranges from the sources yet.
wp plugin get otter-blocks --field=version3.2.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-109936")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.