{"id":"CVE-2026-109933","title":"Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes","summary":"The Otter Blocks  WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbi…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"Otter Blocks","affected":["otter_blocks < 3.2.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T10:39:39.063275Z"},"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:46:04.987Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109933","references":[{"url":"https://wpscan.com/vulnerability/a2a19770-9ee2-4164-9ea6-a882cf0085e9/"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T06:17:25.175Z","slug":"CVE-2026-109933","body":"## Overview\n\nThe Otter Blocks  WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.\n\n## Affected\n\n- `otter_blocks < 3.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228003,"id":"CVE-2026-109933","ts":1792754643472,"field":"cvss","old":null,"new":"6.8"},{"seq":228002,"id":"CVE-2026-109933","ts":1792754643472,"field":"severity","old":"none","new":"medium"}]}