otter_blocks vulnerabilities
CVEs whose affected-version data names the otter_blocks package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-109934Medium· 5.3Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unaut…
CVE-2026-109933Medium· 6.8Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbi…
CVE-2026-109936High· 7.5Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent…
CVE-2026-109935Medium· 5.3Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner r…
CVE-2026-109937Medium· 5.4Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to red…