Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.2.8.

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.2.8.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 3.1.1 to before 3.2.8.

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.2.8. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature. No further endpoint or implementation detail is disclosed beyond the path described here. The official changelog confirms a matching fix in 3.2.7.

Otter Blocks through 3.1.7 does not bind the user-controlled product_id handled by watch_checkout() to the corresponding price_id in a Stripe checkout URL. An unauthenticated buyer can pay for a lower-cost item while obtaining entitlement to a premium product.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.1.4.

Otter - Gutenberg Block is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Otter - Gutenberg Block is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.