The vulnerability resides in the Otter Blocks WordPress plugin before version 3.2.8, where an unbounded pattern used to rewrite dynamic‑content tokens can consume the closing quote of an HTML attribute and inject adjacent unescaped data as new attributes. This flaw enables stored cross‑site scripting that will execute in the browsers of any visitor who loads an affected page, including logged‑in administrators. The weakness is an injection flaw that directly leads to XSS and compromises confidentiality and integrity of user sessions.

The affected product is the Otter Blocks WordPress plugin. Versions prior to 3.2.8 are vulnerable. The exact vendor entry is listed as Unknown:Otter Blocks; the impact applies to any WordPress site deploying the plugin before the specified version.

The flaw can be exploited by unauthenticated users that can initialise or modify the dynamic content within a block. Because the injected payload is stored in the database, every site visitor will receive the malicious markup when the page is rendered. Although no EPSS score is available and the vulnerability is not listed in CISA KEV, the nature of the flaw and its ability to affect administrative sessions imply a high potential for exploitation. The lack of official remediation data means the risk remains significant until a patch is applied.