Stored Cross-Site Scripting Vulnerability in Spectra Gutenberg Blocks for WordPress
CVE-2025-11162
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 November 2025
What is CVE-2025-11162?
The Spectra Gutenberg Blocks plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises due to inadequate input sanitization and output escaping mechanisms in the Custom CSS functionality. Authenticated users with Contributor-level access or higher can exploit this weakness by injecting arbitrary web scripts into web pages. Once an injected page is accessed by users, the malicious scripts will execute, posing serious security risks.
Affected Version(s)
Spectra Gutenberg Blocks – Website Builder for the Block Editor * <= 2.19.14