CVE-2026-109937
Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
| Vendor | unknown |
| Product | otter blocks |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown otter blocks
Be the first to know when new unknown vulnerabilities affecting unknown otter blocks are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Otter Blocks
0 < 3.2.3
References
Credits
John Ryan Albon WPScan