Executive brief
Spectra is a popular WordPress plugin used to enhance the website building experience with custom blocks. A security flaw in the plugin's image block allows users with contributor-level access or higher to embed malicious scripts into pages. When other users or administrators visit these pages, the scripts execute, potentially leading to unauthorized actions or data theft.
Technical details
The Spectra Gutenberg Blocks plugin (formerly Ultimate Addons for Gutenberg) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'uagb/image' block. An authenticated attacker with Contributor-level permissions or higher can inject arbitrary web scripts into the block's attributes. Because the plugin fails to properly neutralize this input before it is stored and subsequently rendered, the script will execute in the browser of any user who views the affected page. This vulnerability is tracked as CWE-79 and affects all versions up to and including 2.19.28.
Affected products
- Brainstorm Force Spectra – WordPress Gutenberg Blocks up to, and including, 2.19.28
Timeline
- 2026-07-20: disclosed: Initial publication of the CVE record.
- 2026-07-20: advisory: Wordfence published the vulnerability details.
References
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.28/blocks-config/image/class-uagb-image.php
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.28/includes/blocks/image/block.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9dc5e3-9d72-4c04-8ba9-56428a6fdddd?source=cve