Otter Blocks CVE-2026-109933

Requires an authenticated account with contributor-level privileges or higher on the target WordPress site (the description says 'contributor-level access and above'), and requires that the attacker use Otter Blocks to supply crafted block styling values, which the plugin fails to sanitize/escape before writing them into an inline stylesheet. The payload is stored and only fires when a victim - any visitor, including an administrator - subsequently views the affected post (UI:R). Limiting factors: exploitation is not fully public (needs at least a contributor account, so sites that do not allow untrusted contributors are far less exposed), and it depends on a victim rendering the poisoned post; it does not require any non-default configuration of the plugin.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Otter Blocks WordPress plugin. The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) signals network reach, low complexity, and high impact, but two signals conflict with the description and warrant caution. First, the vector lists PR:H (high privilege), yet the description explicitly states 'contributor-level access and above' - contributor is a low-privilege role in WordPress, which maps to PR:L, not PR:H; this discrepancy should be verified, as it understates how many accounts can exploit the issue. Second, C:H/I:H/A:H is an aggressive rating for an XSS bug and most likely reflects the worst case where the script runs in an administrator's authenticated session (full-site takeover); typical stored XSS impact is lower. The decision signals point to a moderate, non-emergency priority: SSVC shows Exploitation=none, Automatable=no, Technical Impact=partial, and the vuln.today Decision label is 'this_month' (patch within normal maintenance, not an emergency). There is no CISA KEV listing and no EPSS score was supplied, and no public exploit code is referenced - only WPScan and NVD advisory pages. Net: a genuine but not urgent issue - real because any contributor can plant script that runs in an admin's browser, but gated behind authentication and victim page-views, so it is a priority-patch item rather than a drop-everything emergency.

An attacker who holds (or phishes/registers) a contributor-level account on a multi-author WordPress site edits a post using Otter Blocks and injects a malicious script through unsanitized block styling values, which get written verbatim into an inline stylesheet. When an administrator later opens or previews that post, the script executes in their authenticated browser session, enabling session/cookie theft or admin actions. No public exploit code is referenced, though a WPScan advisory describes the issue.