CVE-2026-109936

Name of the Vulnerable Software and Affected Versions Otter Blocks WordPress plugin versions prior to 3.2.8

Description An issue exists where the software fails to correctly bound a pattern used to rewrite dynamic-content tokens during block rendering. This flaw allows the pattern to consume the closing quote of an HTML attribute, pulling adjacent unescaped data into the markup as new attributes. Consequently, unauthenticated users can perform stored Cross-Site Scripting (XSS), which is a technique that injects malicious scripts into a webpage, executing them in the browser of any visitor who views the affected page, including logged-in administrators.

Recommendations Update Otter Blocks WordPress plugin to version 3.2.8 or later.