medium5.4
CVE-2026-109937
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destin…
Impact
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
Affected products
| Product | Affected versions |
|---|---|
| Otter Blocks WordPress Plugin | before 3.2.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.