CVE-2026-125800: WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/ultimate-addons-for-gutenbergto a version that resolves this vulnerability.Fixed in 2.20.6
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and requires user interaction. The attack can be performed over the network with low complexity.
What impact could successful exploitation have?
Successful stored XSS exploitation can affect confidentiality, integrity, and availability at a low level. The scope is changed, meaning the impact may extend beyond the vulnerable component's security authority.
Which Spectra versions are affected?
Spectra versions through 2.20.5 are affected. The available data does not identify a fixed version.