CVE-2026-109933 — Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

CVE-2026-109933

Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes PUBLISHED

Description (CNA)

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.

Affected (CNA)

Vendor / product	Versions
Unknown / Otter Blocks	affected 0 before 3.2.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a2a19770-9ee2-4164-9ea6-a882cf0085e9/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.