{
 "id": "WPSEC-2026-1359",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1359/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1359/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1359/index.md",
 "title": "Otter Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Atomic Wind CSS",
 "description": "The Otter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Atomic Wind CSS in versions from 3.1.6 up to, and including, 3.2.7. Generated Atomic Wind stylesheet text, saved through the plugin's style REST route and later printed inside an inline <style> element, was not fully neutralized against a closing style tag, so a crafted value could terminate the <style> element early. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an affected page.",
 "plugin": {
  "slug": "otter-blocks",
  "name": "Otter Blocks",
  "full_name": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
  "wordpress_org": "https://wordpress.org/plugins/otter-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/otter-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/otter-blocks"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1.6",
    "from_inclusive": true,
    "to": "3.2.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1.6 before 3.2.8"
  ]
 },
 "introduced_in": "3.1.6",
 "fixed_in": "3.2.8",
 "remediation": "Update to 3.2.8 or later.",
 "fix_released": "2026-10-19T06:48:07+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:33:30.744039+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1359/",
  "https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.8/",
  "https://wordpress.org/plugins/otter-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/otter-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}