Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Otter Blocks 3.2.8 Clear all filters
TI-2026-79564 CVE-2026-109936 · GHSA-7hjg-79p8-hrjm

Stored cross-site scripting in Otter Blocks WordPress plugin

Priority LOW 35

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute a…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00282 Published 2026-10-23 Fixed in 3.2.8 CWE-79
TI-2026-79563 CVE-2026-109935 · GHSA-3jfj-x8x5-pch2

Access control bypass in Otter Blocks exposes restricted block content

Priority LOW 30

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00282 Published 2026-10-23 Fixed in 3.2.8 CWE-200
TI-2026-79562 CVE-2026-109934 · GHSA-v2v8-j877-jpr5

Otter Blocks exposes non-public content through REST API

Priority LOW 24

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00282 Published 2026-10-23 Fixed in 3.2.8 CWE-200
TI-2026-79561 CVE-2026-109933 · GHSA-655q-x6wx-x8mp

Stored cross-site scripting in Otter Blocks plugin via block styles

Priority LOW 30

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and abov…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00306 Published 2026-10-23 Fixed in 3.2.8 CWE-79