WordPress Plugin Vulnerabilities

Spectra < 2.19.29 - Contributor+ Stored XSS via uagb/image Block

Description

The plugin does not sanitise and escape some block attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affects Plugins

Plugin icon
ultimate-addons-for-gutenberg
Fixed in 2.19.29

References

CVE
CVE-2026-12900
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9dc5e3-9d72-4c04-8ba9-56428a6fdddd

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
theviper17y
Verified
No
WPVDB ID
b42bc51c-8b40-4e82-a71e-db3204ec71fa

Timeline

Publicly Published
2026-07-20 (about 9 days ago)
Added
2026-07-20 (about 8 days ago)
Last Updated
2026-07-20 (about 8 days ago)

Other

Published
Title
Published
2024-10-21
Title
WP ERP < 1.13.3 - Reflected Cross-Site Scripting
Published
2026-02-26
Title
List category posts < 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2026-02-05
Title
Yoast SEO < 26.9 - Contributor+ Stored XSS
Published
2025-01-16
Title
Sidebar-Content from Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-08
Title
Pull This <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting