---
id: "CVE-2026-109936"
kind: "vulnerability"
aliases: ["CVE-2026-109936"]
title: "Otter Blocks WordPress plugin: unbounded regex lets visitors inject stored script"
severity: "high"
cvss: 7.5
epss: 0.00173
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["otter-blocks", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-version-3.2.8-or-later"]
published_at: "2026-10-23T06:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:14:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109936", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109936", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Otter Blocks WordPress plugin: unbounded regex lets visitors inject stored script

The Otter Blocks WordPress plugin before 3.2.8 rewrites dynamic-content tokens with a pattern that can consume the closing quote of an HTML attribute, pulling adjacent unescaped data into the page as new attributes. An unauthenticated attacker can plant stored cross-site scripting that runs in the browser of any visitor to an affected page, including logged-in administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Otter Blocks plugin version in the WordPress admin under Plugins, or with `wp plugin get otter-blocks --field=version`
- Confirm whether any page built with Otter Blocks dynamic content renders attributes from user-supplied data

## Fix

- Update the Otter Blocks plugin to `3.2.8` or later
- Review pages that use Otter Blocks dynamic content for injected script after updating

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109936
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109936

## From the sources

The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_