This vulnerability is a stored cross‑site scripting flaw in the Otter Blocks WordPress plugin, allowing contributors or higher‑privileged users to inject arbitrary scripts into block style attributes. Because the plugin writes unsanitized user input into inline styles, any visitor who views the affected post, including administrators, will execute the attacker’s code, posing a substantial confidentiality and integrity risk.

The issue affects the Otter Blocks plugin for WordPress on all installations running a version earlier than 3.2.8.

Given that the flaw requires only contributor‑level access—an access role commonly granted to content editors—the attack vector is both local and potentially remote if an attacker can create a contributor account or compromise existing credentials. The CVSS score is 6.8, indicating a moderate severity. The EPSS score is not available, but the nature of stored XSS combined with common use of contributor roles makes the risk high. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet, but the impact warrants immediate patching.