What’s Vulnerable › Products

themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE version is affected

Latest themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE vulnerabilities

• CVE-2026-109936 — Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter (CVSS 7.5)
• CVE-2026-109935 — Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API (CVSS 5.3)
• CVE-2026-109934 — Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API (CVSS 5.3)
• CVE-2026-109933 — Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes (CVSS 6.8)
• CVE-2026-109937 — Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block (CVSS 5.4)
• CVE-2026-102002 — Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget (CVSS 3.1)
• CVE-2026-4945 — Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass (CVSS 5.3)
• CVE-2026-2892 — Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie (CVSS 7.5)
• CVE-2024-11219 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View (CVSS 7.5)
• CVE-2024-10367 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
• CVE-2024-35682 — WordPress Otter Blocks PRO plugin <= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability (CVSS 5.3)
• CVE-2024-3725 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' (CVSS 5.4)
• CVE-2024-2729 — Otter Blocks < 2.6.6 - Contributor+ Stored XSS (CVSS 6.1)
• CVE-2024-3344 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-3343 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 5.4)
• CVE-2024-2226 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-2841 — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-1691 — Otter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload (CVSS 6.1)
• CVE-2024-1684 — Otter Blocks PRO <= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS (CVSS 5.4)