{"id":"CVE-2026-109936","kind":"vulnerability","aliases":["CVE-2026-109936"],"related":[],"title":"Otter Blocks WordPress plugin: unbounded regex lets visitors inject stored script","description":"The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.","summary":"The Otter Blocks WordPress plugin before 3.2.8 rewrites dynamic-content tokens with a pattern that can consume the closing quote of an HTML attribute, pulling adjacent unescaped data into the page as new attributes. An unauthenticated attacker can plant stored cross-site scripting that runs in the browser of any visitor to an affected page, including logged-in administrators.","severity":"high","cvss":7.5,"epss":0.00173,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["otter-blocks","package","self-hosted","wordpress"],"not_affected_if":["plugin-version-3.2.8-or-later"],"how_to_check":"- Check the installed Otter Blocks plugin version in the WordPress admin under Plugins, or with `wp plugin get otter-blocks --field=version`\n- Confirm whether any page built with Otter Blocks dynamic content renders attributes from user-supplied data","fix":"- Update the Otter Blocks plugin to `3.2.8` or later\n- Review pages that use Otter Blocks dynamic content for injected script after updating","status":"open","published_at":"2026-10-23T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:14:59+00:00","updated_at":"2026-10-25T03:14:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:14:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Otter Blocks plugin to `3.2.8` or later\n- Review pages that use Otter Blocks dynamic content for injected script after updating","reach":"internet","title":"Otter Blocks WordPress plugin: unbounded regex lets visitors inject stored script","impact":"high","summary":"The Otter Blocks WordPress plugin before 3.2.8 rewrites dynamic-content tokens with a pattern that can consume the closing quote of an HTML attribute, pulling adjacent unescaped data into the page as new attributes. An unauthenticated attacker can plant stored cross-site scripting that runs in the browser of any visitor to an affected page, including logged-in administrators.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","otter-blocks"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs script in any visitor's browser, including administrators","analyst_note":"Confirm which dynamic-content blocks and attribute paths are exploitable, and whether the fixed release is 3.2.8 per the NVD record.","how_to_check":"- Check the installed Otter Blocks plugin version in the WordPress admin under Plugins, or with `wp plugin get otter-blocks --field=version`\n- Confirm whether any page built with Otter Blocks dynamic content renders attributes from user-supplied data","needs_analyst":true,"not_affected_if":["plugin-version-3.2.8-or-later"],"who_is_affected":"Sites running the Otter Blocks WordPress plugin older than 3.2.8 that render dynamic-content blocks with adjacent unescaped data are exposed, and the attack needs no account. Sites that do not run the plugin, or run 3.2.8 or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":3422,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109936':14A,17A '-2026':13A,16A '3.2.8':32B,94C 'achiev':141C 'adjac':52B,127C 'administr':87B,165C 'affect':81B,158C 'allow':137C 'attack':63B 'attribut':50B,60B,124C,135C 'block':2A,20B,28B,90C,112C 'bound':98C 'browser':75B,151C 'close':45B,121C 'consum':43B,117C 'content':36B,108C 'correct':97C 'cross':68B,144C 'cross-sit':67B,143C 'cve':12A,15A 'data':54B,129C 'dynam':35B,107C 'dynamic-cont':34B,106C 'execut':148C 'host':24B 'html':49B,123C 'includ':83B,160C 'inject':9A 'let':7A 'log':85B,163C 'logged-in':84B,162C 'markup':132C 'new':59B,134C 'otter':1A,19B,27B,89C 'otter-block':18B 'packag':21B 'page':57B,82B,159C 'pattern':40B,100C,115C 'plant':65B 'plugin':4A,30B,92C 'pull':51B,126C 'quot':46B,119C 'regex':6A 'render':111C 'rewrit':33B,104C 'run':72B 'script':11A,70B,146C 'self':23B 'self-host':22B 'site':69B,145C 'store':10A,66B,142C 'token':37B,109C 'unauthent':62B,138C 'unbound':5A 'unescap':53B,128C 'use':102C 'user':139C 'view':156C 'visitor':8A,78B,154C 'wordpress':3A,25B,29B,91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Otter Blocks WordPress plugin older than 3.2.8 that render dynamic-content blocks with adjacent unescaped data are exposed, and the attack needs no account. Sites that do not run the plugin, or run 3.2.8 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109936","severity":null,"published_at":"2026-10-23T06:17:05+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109936","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109936","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}