The vulnerability resides in the Otter Blocks WordPress plugin prior to version 3.2.8, where an unbounded pattern used to rewrite dynamic‑content tokens can consume the closing quote of an HTML attribute and inject adjacent unescaped data as new attributes. This flaw enables stored cross‑site scripting that will execute in the browsers of any visitor who loads an affected page, including logged‑in administrators. The weakness is an input‑validation flaw that directly leads to XSS, compromising the confidentiality and integrity of user sessions.

The affected product is the Otter Blocks WordPress plugin. Versions before 3.2.8 are vulnerable. Any WordPress site deploying the plugin earlier than that version is impacted; the vendor entry appears as Unknown:Otter Blocks in the CNA records.

The likely attack vector is unauthenticated application access that permits inclusion of malicious dynamic content tokens. Attackers may manipulate or inject such tokens, causing the plugin to store harmful markup. The CVSS score of 7.5 indicates high severity. Because the injected payload is stored in the database and served to every site visitor, the impact is widespread. No EPSS score is available, and the flaw is not listed in CISA KEV, but the high severity combined with the stored nature of the payload suggests a significant risk until a patch is applied.