CVE-2026-109936: CWE-79 Cross-Site Scripting (XSS) in Otter Blocks

CVE-2026-109936 is a stored Cross-Site Scripting vulnerability in the Otter Blocks WordPress plugin prior to version 3.2.8. The vulnerability occurs because the plugin does not correctly limit the pattern used to rewrite dynamic-content tokens during block rendering. This allows the pattern to consume the quote that closes an HTML attribute, pulling adjacent unescaped data into the markup as new attributes. Consequently, unauthenticated users can inject malicious scripts that execute in the browsers of any visitors who view the affected content, including logged-in administrators.

An unauthenticated attacker can exploit this vulnerability to perform stored XSS attacks, leading to arbitrary script execution in the context of any user viewing the affected page. This includes administrators, potentially allowing theft of credentials, session hijacking, or other malicious actions executed with the privileges of the victim user.

A fix is available in Otter Blocks version 3.2.8. Users should upgrade to version 3.2.8 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary as the issue is resolved by the official update.