Stored Cross-Site Scripting Vulnerability in Spectra Gutenberg Blocks Plugin for WordPress

CVE-2026-12900

What is CVE-2026-12900?

The Spectra Gutenberg Blocks plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability, allowing authenticated users with Contributor-level access and higher to inject arbitrary scripts through the uagb/image block. This flaw arises from inadequate input sanitization and output escaping, leading to potential script execution on pages accessed by users. All versions up to and including 2.19.28 are affected, emphasizing the necessity for prompt updates to mitigate security threats. For additional details, consult the provided references.

References