blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-109936

HIGH 7.5 CVSS 3.1
Published
October 23, 2026
Last modified
October 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.

Affected products and versions

  • Unknown Otter Blocks — Before 3.2.8

References

  • wpscan.com https://wpscan.com/vulnerability/c9f264ad-0857-4d1f-9f20-694469d7bee0/
  • nvd.nist.gov Official NVD record