The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an… (CVE-2026-109933)

CVE-2026-109933 describes a cross-site scripting (XSS) vulnerability in the Otter Blocks WordPress plugin prior to version 3.2.8. The plugin fails to properly sanitize and escape user-supplied styling values for blocks before embedding them into inline stylesheets. This improper handling enables users with contributor or higher privileges to inject malicious scripts that execute in the context of any visitor viewing the post, potentially compromising confidentiality, integrity, and availability.

Successful exploitation allows an attacker with contributor-level access or above to perform stored cross-site scripting attacks. This can lead to arbitrary script execution in the browsers of visitors and administrators, potentially resulting in session hijacking, privilege escalation, or other malicious actions impacting confidentiality, integrity, and availability of the affected WordPress site.

Upgrade the Otter Blocks plugin to version 3.2.8 or later, where this vulnerability is fixed. Since no patch links are provided, check the official Otter Blocks plugin repository or vendor advisory for the official update. Until patched, restrict contributor-level access and above to trusted users only to reduce risk.