WordPress Plugin Vulnerabilities

Spectra < 2.19.1 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the uagb block due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
ultimate-addons-for-gutenberg
Fixed in 2.19.1

References

CVE
CVE-2025-1784
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac33fd5-602b-4810-96e1-850ea6ee739d

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Peter Thaleikis
Verified
No
WPVDB ID
6a7375ed-b496-4a95-b9c5-279649917bdc

Timeline

Publicly Published
2025-03-25 (about 1 year ago)
Added
2025-03-26 (about 1 year ago)
Last Updated
2025-03-26 (about 1 year ago)

Other

Published
Title
Published
2026-02-10
Title
Category Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter
Published
2023-12-27
Title
Dan's Embedder for Google Calendar < 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-04-04
Title
Arkhe Blocks <= 2.27.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-11
Title
Smaily for WP < 3.1.6 - Contributor+ Stored XSS
Published
2023-02-13
Title
Advanced Recent Posts <= 0.6.14 - Contributor+ Stored XSS