{"id":"CVE-2026-109937","published":"2026-10-18T07:16:50.927","lastModified":"2026-10-18T07:16:50.927","description":"The Otter Blocks  WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}