CVE-2026-109933: Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

Q: Who can exploit this issue?

A user with contributor-level access or higher can exploit it by supplying malicious block styling values in a post.

Q: Who is affected when malicious content is published?

Any visitor who views the affected post can have arbitrary web scripts executed in their browser, including WordPress administrators.

Q: Are sites using the fixed release affected?

The issue affects Otter Blocks versions before 3.2.8. Version 3.2.8 is not identified as affected by the provided information.

Published Oct 23, 2026

Updated

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.

Affected Software

1 affected component

Themeisle Otter Blocks<3.2.8

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access or higher can exploit it by supplying malicious block styling values in a post.

Who is affected when malicious content is published?

Any visitor who views the affected post can have arbitrary web scripts executed in their browser, including WordPress administrators.

Are sites using the fixed release affected?

The issue affects Otter Blocks versions before 3.2.8. Version 3.2.8 is not identified as affected by the provided information.

CVE-2026-109933: Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Who is affected when malicious content is published?

Are sites using the fixed release affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Who is affected when malicious content is published?

Are sites using the fixed release affected?