--- title: "Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/themeisle/otter-blocks-gutenberg-blocks-page-builder-for-gutenberg-editor-and-fse type: product description: "Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE has 11 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-10-02 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE vulnerabilities Vendor: [Themeisle](https://radicalnotion.ai/vendor/themeisle) - **Published CVEs:** 11 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 11 - **Average CVSS:** 6.1 - **First CVE:** 2024-02-02 - **Latest CVE:** 2026-10-02 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 2 | | Medium | 8 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 4 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-285](https://radicalnotion.ai/cwe/cwe-285) | Improper Authorization | 1 | | [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 | | [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 1 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2024 | 8 | | 2025 | 0 | | 2026 | 3 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \<= 2.6.8 | range | 2 | | \<= 2.6.2 | range | 1 | | \<= 2.6.4 | range | 1 | | \<= 2.6.5 | range | 1 | | \<= 2.6.9 | range | 1 | | \<= 3.0.4 | range | 1 | | \<= 3.0.6 | range | 1 | | \<= 3.1.4 | range | 1 | | \<= 3.1.7 | range | 1 | | \<= 3.2.6 | range | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-102002 | Otter Blocks \<= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget | low | 3.1 | No | No | Yes | | CVE-2026-4945 | Otter Blocks \<= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass | medium | 5.3 | No | No | Yes | | CVE-2026-2892 | Otter Blocks \<= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie | high | 7.5 | No | No | Yes | | CVE-2024-11219 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View | high | 7.5 | No | No | Yes | | CVE-2024-10367 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload | medium | 6.4 | No | No | Yes | | CVE-2024-3725 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' | medium | 6.4 | No | No | Yes | | CVE-2024-3344 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes | | CVE-2024-3343 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes | medium | 6.4 | No | No | Yes | | CVE-2024-2226 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes | | CVE-2024-2841 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes | | CVE-2024-1047 | ThemeIsle SDK \<= Various Versions - Missing Authorization | medium | 5.3 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE have? Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE has 11 published CVE records since 2024. ### How many Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CVEs are in CISA KEV? None of Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE vulnerabilities? No Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CVEs currently have a tracked public exploit in this dataset. ### Which versions of Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE are affected? 10 distinct Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CVEs? Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-285 (Improper Authorization). ### What is the average severity of Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CVEs? The average CVSS base score across Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE's scored CVEs is 6.1. ## Other products from this vendor - [RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy-feed-to-post-autoblogging-news-and-youtube-video-feeds-aggregator) (17 CVEs) - [orbit fox](https://radicalnotion.ai/vendor/themeisle/orbit-fox) (15 CVEs) - [Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More](https://radicalnotion.ai/vendor/themeisle/orbit-fox-duplicate-page-menu-icons-svg-support-cookie-notice-custom-fonts-and-more) (14 CVEs) - [multiple page generator](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator) (11 CVEs) - [Multiple Page Generator Plugin – MPG](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator-plugin-mpg) (11 CVEs) - [otter blocks](https://radicalnotion.ai/vendor/themeisle/otter-blocks) (10 CVEs) - [Redirection for Contact Form 7](https://radicalnotion.ai/vendor/themeisle/redirection-for-contact-form-7) (9 CVEs) - [rss aggregator by feedzy](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy) (9 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/themeisle/otter-blocks-gutenberg-blocks-page-builder-for-gutenberg-editor-and-fse). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.