What is CVE-2026-109936?

CVE-2026-109936 is a high-severity vulnerability in Otter Blocks, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2026-10-23.

How severe is CVE-2026-109936?

High severity. CVSS v3 base score is 7.5 out of 10.

XSS in Otter Blocks

CVE-2026-109936

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-10-23 · last modified 2026-10-23.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Otter Blocks

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

wpscan.com/vulnerability/c9f264ad-0857-4d1f-9f20-694469d7bee0/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-109936?: CVE-2026-109936 is a high-severity vulnerability in Otter Blocks, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2026-10-23.
How severe is CVE-2026-109936?: High severity. CVSS v3 base score is 7.5 out of 10.