An unauthenticated attacker can inject malicious web scripts into pages using the Otter Blocks plugin due to insufficient input sanitization and output…
Affected component: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (plugin)
Fixed in: 3.2.8
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 25, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.2.8 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-109936