CVE-2026-109933 - Vulnerability Details - OpenCVE

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wordpress-extensions	Otter Blocks

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/a2a19770-9ee2-4164-9ea6-a882cf0085e9/

History

Fri, 23 Oct 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 23 Oct 2026 08:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions otter Blocks
Vendors & Products		Wordpress-extensions Wordpress-extensions otter Blocks

Fri, 23 Oct 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79

Fri, 23 Oct 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
Title		Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
References		https://wpscan.com/vulnerability/a2a19770-9ee2-4164-9ea6-a882cf0085e9/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-10-23T06:00:17.572Z

Updated: 2026-10-23T10:46:04.987Z

Reserved: 2026-10-13T11:14:40.742Z

Link: CVE-2026-109933

Vulnrichment

Updated: 2026-10-23T10:39:32.131Z

NVD

Status : Deferred

Published: 2026-10-23T06:17:05.170

Modified: 2026-10-23T14:20:57.920

Link: CVE-2026-109933

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109933", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-13T11:14:40.742Z", "datePublished": "2026-10-23T06:00:17.572Z", "dateUpdated": "2026-10-23T10:46:04.987Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-23T06:00:17.572Z"}, "title": "Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Otter Blocks", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.2.8"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post."}], "references": [{"url": "https://wpscan.com/vulnerability/a2a19770-9ee2-4164-9ea6-a882cf0085e9/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Karthik Ramakrishnan", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109933", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T10:39:39.063275Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T10:46:04.987Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109933", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-13T11:14:40.742Z", "datePublished": "2026-10-23T06:00:17.572Z", "dateUpdated": "2026-10-23T06:00:17.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-23T06:00:17.572Z"}, "title": "Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Otter Blocks", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.2.8"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post."}], "references": [{"url": "https://wpscan.com/vulnerability/a2a19770-9ee2-4164-9ea6-a882cf0085e9/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Karthik Ramakrishnan", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109933", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T10:39:39.063275Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-23T10:39:32.131Z"}, "title": "CISA ADP Vulnrichment"}]}}