The Otter Blocks WordPress plugin before 3.2.8 has a stored Cross-Site Scripting (XSS) vulnerability via the dynamic content render filter. This allows unauthenticated users to execute stored XSS in the browser of any visitor who views an affected page. The vulnerability arises from the plugin's failure to correctly bound a pattern used to rewrite dynamic-content tokens while rendering blocks, potentially [truncated]
CVE-2026-109935 debrief based on CVE Program and NVD records. The Otter Blocks WordPress plugin before version 3.2.8 does not enforce block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content restricted to specific roles, logged-in users, post authors, categories, or tags. Site owners and administrators should assess [truncated]
CVE-2026-109934 is a vulnerability in the Otter Blocks WordPress plugin that allows unauthenticated users to access non-public content via a REST API endpoint. The plugin does not correctly determine whether a post is publicly readable before returning its data, treating any post with the published status as public. This can lead to the disclosure of manual excerpts of password-protected posts, content an [truncated]
CVE-2026-109933 is a stored XSS vulnerability in the Otter Blocks WordPress plugin before version 3.2.8. The plugin does not properly sanitize and escape user-supplied block styling values, allowing contributors and above to inject web scripts. These scripts execute when any visitor, including administrators, views the affected post. The vulnerability impacts site integrity and user trust, and defenders s [truncated]
