Spectra Gutenberg Blocks <= 2.19.28 Authenticated Stored XSS (CVE-2026-12900)

Vulnerability Overview Vulnerability Name: Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block CVE ID: CVE-2026-12900 CVSS Score: 6.4 (Medium) Publication Date: July 20, 2026 Last Updated Date: July 20, 2026 Researcher: theviper17y Impact Scope Software Type: Plugin Software Name: Spectra Legacy – Gutenberg Blocks Software Version: <= 2.19.28 Affected Versions: <= 2.19.28 Fixed Version: 2.19.29 Remediation Mitigation: Update to version 2.19.29 or later. Additional Information Vulnerability Description: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uagb/image' block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes - CVE ID: CVE-2026-7405 - CVSS Score: 8.8 - Researcher: kai63001 - Publication Date: May 29, 2026 Spectra <= 2.19.22 - Missing Authorization - CVE ID: CVE-2026-42648 - CVSS Score: 4.3 - Researcher: Trương Hữu Phúc (truonghuphuc) - Publication Date: March 27, 2026 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data - CVE ID: CVE-2026-0950 - CVSS Score: 5.3 - Researcher: jdnka - Publication Date: February 2, 2026 Spectra <= 2.19.17 - Missing Authorization - CVE ID: CVE-2026-24982 - CVSS Score: 5.3 - Researcher: Bao - BlueRock - Publication Date: January 17, 2026 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS - CVE ID: CVE-2025-11162 - CVSS Score: 6.4 - Researcher: Muhammad Yudha - DJ - Publication Date: November 4, 2025 Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-1784 - CVSS Score: 6.4 - Researcher: Peter Thaleikis - Publication Date: March 25, 2025 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget - CVE ID: CVE-2024-10484 - CVSS Score: 6.4 - Researcher: zer0h0x - Publication Date: December 2, 2024 Spectra – WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-7590 - CVSS Score: 6.4 - Researcher: João Pedro Soares de Almeida - Publication Date: August 7, 2024 Spectra <= 2.13.7 - Missing Authorization via generate_ai_content - CVE ID: CVE-2024-37517 - CVSS Score: 4.3 - Researcher: Rafie Muhammad - Publication Date: July 5, 2024 Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting - CVE ID: CVE-2024-4386 - CVSS Score: 6.4 - Researcher: Ngô Thiên An (ancon_) - Publication Date: May 23, 2024 Additional Information Copyright: Copyright 2012-2026 Defiant Inc. License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Contact Information: Have information to add, or spot any errors? Contact us at wi-support@wordfence.com so we can make any appropriate adjustments. Recent Vulnerabilities Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes - CVE ID: CVE-2026-7405 - CVSS Score: 8.8 - Researcher: kai63001 - Publication Date: May 29, 2026 Spectra <= 2.19.22 - Missing Authorization - CVE ID: CVE-2026-42648 - CVSS Score: 4.3 - Researcher: Trương Hữu Phúc (truonghuphuc) - Publication Date: March 27, 2026 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data - CVE ID: CVE-2026-0950 - CVSS Score: 5.3 - Researcher: jdnka - Publication Date: February 2, 2026 Spectra <= 2.19.17 - Missing Authorization - CVE ID: CVE-2026-24982 - CVSS Score: 5.3 - Researcher: Bao - BlueRock - Publication Date: January 17, 2026 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS - CVE ID: CVE-2025-11162 - CVSS Score: 6.4 - Researcher: Muhammad Yudha - DJ - Publication Date: November 4, 2025 Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-1784 - CVSS Score: 6.4 - Researcher: Peter Thaleikis - Publication Date: March 25, 2025 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget - CVE ID: CVE-2024-10484 - CVSS Score: 6.4 - Researcher: ze

Goal Reached Thanks to every supporter — we hit 100%!

Spectra Gutenberg Blocks <= 2.19.28 Authenticated Stored XSS (CVE-2026-12900)

More from this source