CVE-2026-109936: Otter Blocks 0 to before 3.2.8

Affected technology

Otter Blocks · 0 to before 3.2.8
Vendor not specified by the source

Description’s affected range: before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks

Component: Not specified by the source

What an attacker can do

Unauthenticated users can achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.