# Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.2.9 - Unauthenticated Dynamic Content Marker Injection via Comments, Search Queries and Other Visitor-Supplied Content

- **ID:** WPSEC-2026-2812
- **Plugin:** Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (`otter-blocks`), https://wordpress.org/plugins/otter-blocks/
- **Affected versions:** from 2.0.9 before 3.2.10
- **Fixed in:** 3.2.10 (Update to 3.2.10 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/otter-blocks
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2812/

## Description

The Otter Blocks plugin for WordPress is vulnerable to Dynamic Content Marker Injection via visitor-supplied text such as comment text and author fields, search queries, author names and term names in all versions up to, and including, 3.2.9, due to rendered block output being passed through the plugin's dynamic content filters without first neutralising dynamic markers (such as {otterDynamic?...} magic tags, #otterDynamicLink and otter/v1/dynamic image URLs) that came from untrusted sources. This makes it possible for unauthenticated attackers to have the site resolve dynamic values on output. Depending on the page, this can disclose data the attacker should not see, such as featured images of private or draft posts, and inject extra content into the page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2812/
- https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.10/
- https://wordpress.org/plugins/otter-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2812/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.