Executive brief
Spectra, a popular WordPress plugin used for building website pages, contains a security flaw in how it handles block style attributes. An authorized user with at least 'Contributor' permissions can inject malicious CSS code into website pages. This could allow an attacker to deface the website, trick visitors into interacting with malicious elements, or potentially steal sensitive information through advanced styling techniques.
Technical details
The Spectra plugin fails to properly validate or escape several block style attributes before incorporating them into the CSS generated for the front end. An attacker with Contributor-level privileges or higher can exploit this by saving a post or page containing a specially crafted block. When other users (including anonymous visitors) view the affected page, the injected CSS is executed by their browser. While WordPress's KSES filtering prevents full Cross-Site Scripting (XSS) by stripping script tags, the CSS injection can still be used for page defacement, UI redressing, or data exfiltration via CSS attribute selectors. The issue is resolved in version 2.20.0.
Affected products
- Brainstorm Force Spectra (Ultimate Addons for Gutenberg) < 2.20.0
Timeline
- 2026-07-20: disclosed: Publicly published by WPScan
- 2026-07-20: patched: Fixed in version 2.20.0
- 2026-08-01: advisory: NVD advisory published