PT-2026-121759
CVE-2026-109933
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾