The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering… (CVE-2026-109936)

CVE-2026-109936 affects the Otter Blocks WordPress plugin prior to version 3.2.8. The vulnerability arises because the plugin does not correctly bound a pattern used to rewrite dynamic-content tokens during block rendering. This improper bounding causes the pattern to consume the closing quote of an HTML attribute and pull in adjacent unescaped data, injecting it as new attributes into the markup. This behavior enables unauthenticated attackers to store malicious scripts that execute in the browsers of any visitor who loads the affected page, including logged-in administrators. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction.

An unauthenticated attacker can exploit this vulnerability to perform stored Cross-Site Scripting (XSS) attacks. This can lead to execution of arbitrary scripts in the context of any user viewing the affected page, including administrators. The impact includes potential theft of sensitive information, session hijacking, and other malicious actions executed with the privileges of the victim user.

A fix is available in Otter Blocks version 3.2.8. Users should upgrade to version 3.2.8 or later to remediate this vulnerability. No additional mitigations are specified in the provided data.