{
 "id": "WPSEC-2026-2812",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2812/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2812/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2812/index.md",
 "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.2.9 - Unauthenticated Dynamic Content Marker Injection via Comments, Search Queries and Other Visitor-Supplied Content",
 "description": "The Otter Blocks plugin for WordPress is vulnerable to Dynamic Content Marker Injection via visitor-supplied text such as comment text and author fields, search queries, author names and term names in all versions up to, and including, 3.2.9, due to rendered block output being passed through the plugin's dynamic content filters without first neutralising dynamic markers (such as {otterDynamic?...} magic tags, #otterDynamicLink and otter/v1/dynamic image URLs) that came from untrusted sources. This makes it possible for unauthenticated attackers to have the site resolve dynamic values on output. Depending on the page, this can disclose data the attacker should not see, such as featured images of private or draft posts, and inject extra content into the page.",
 "plugin": {
  "slug": "otter-blocks",
  "name": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
  "full_name": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
  "wordpress_org": "https://wordpress.org/plugins/otter-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/otter-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/otter-blocks"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.9",
    "from_inclusive": true,
    "to": "3.2.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.9 before 3.2.10"
  ]
 },
 "introduced_in": "2.0.9",
 "fixed_in": "3.2.10",
 "remediation": "Update to 3.2.10 or later.",
 "fix_released": "2026-11-09T13:40:11+00:00",
 "published": "2026-11-10T13:45:29+00:00",
 "updated": "2026-11-09T23:33:31.186972+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2812/",
  "https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.10/",
  "https://wordpress.org/plugins/otter-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/otter-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}