Now officially on WordPress.org

CVE Database / CVE-2026-10827

CVE

CVE-2026-10827 — Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] < 2.20.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-10827 Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] < 2.20.0 Insufficient Verification of Data Authenticity Unknown < 2.20.0 2.20.0 2026-07-20 —

CVE-2026-10827

The Spectra Legacy WordPress plugin before version 2.20.0 fails to properly sanitize and validate certain CSS attributes, allowing users with contributor-level access or higher to inject arbitrary CSS code into the pages they can edit. This injected CSS is then displayed to all visitors of those pages, potentially allowing attackers to load external resources, modify the page's appearance, or extract sensitive data. However, the plugin's security features prevent the execution of JavaScript code, limiting the impact to CSS injection only.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings