Otter Blocks (Unknown) - vulnerabilities (CVEs)

6 CVEs, 5 in the last 30 days, 2 known versions, newest CVE from 2026-10-23. Vendor: Unknown.

CVEs of Otter Blocks

• CVE-2026-109936 - CVSS 7.5 (high), 2026-10-23: The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the…
• CVE-2026-109935 - CVSS 5.3 (medium), 2026-10-23: The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST…
• CVE-2026-109934 - CVSS 5.3 (medium), 2026-10-23: The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API…
• CVE-2026-109933 - CVSS 6.8 (medium), 2026-10-23: The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline…
• CVE-2026-109937 - CVSS 5.4 (medium), 2026-10-18: The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return…
• CVE-2024-2729 - CVSS 6.1 (medium), 2024-04-18: The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block,…