Ultimate Addons for Gutenberg <2.20.0 Contributor+ Stored CSS Injection (CVE-2026-10827)

Vulnerability Overview Vulnerability Name: Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes Description: This plugin fails to validate or escape several block style attributes, allowing users with the Contributor role and above to inject arbitrary CSS into pages rendering the affected blocks. The injected styles are visible to anonymous visitors, potentially leading to external resource loading, page tampering, or data leakage. Since JavaScript execution is not feasible under this role (script tags are stripped by KSES), the impact is limited to CSS injection. CVE ID: CVE-2026-10827 Classification: - Type: CONTENT INJECTION - OWASP Top 10: A1: Injection - CWE: CWE-345 - CVSS: 3.5 (low) Affected Range Affected Plugin: ultimate-addons-for-gutenberg Fixed Version: 2.20.0 Remediation Fixed Version: Upgrade to version 2.20.0 or higher. Timeline Public Disclosure Date: 2026-07-20 Added Date: 2026-07-20 Last Updated Date: 2026-07-20 Additional Information Original Researcher: Muni Nitish Kumar Yaddala Submitter: Muni Nitish Kumar Yaddala Verification Status: Yes WPVDB ID: 068ac525-423b-42f8-9ef4-f102f948dc78 Related Vulnerabilities Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment TI WooCommerce Wishlist < 2.11.0 - Unauthenticated HTML Injection WooCommerce < 9.0.0 - Shop Manager+ Content Injection Car Dealer < 4.16 - Admin+ Content Injection Contact Form 7 - PayPal & Stripe Add-on < 2.4.10 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification) Proof of Concept (POC) POC Display Date: 2026-08-03

Goal Reached Thanks to every supporter — we hit 100%!

Ultimate Addons for Gutenberg <2.20.0 Contributor+ Stored CSS Injection (CVE-2026-10827)

More from this source