{"id":"CVE-2026-125800","kind":"vulnerability","aliases":["CVE-2026-125800"],"related":[],"title":"Spectra WordPress block plugin: stored XSS through 2.20.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.","summary":"Brainstorm Force's Spectra (Ultimate Addons for Gutenberg) WordPress plugin has a stored cross-site scripting flaw, where unsafe input is saved and later rendered in pages. An attacker who can get script into stored content can run it in other visitors' browsers, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","spectra","ultimate-addons-for-gutenberg","wordpress"],"not_affected_if":["plugin-above-2.20.5","plugin-not-installed"],"how_to_check":"- Check the installed Spectra plugin version in the WordPress admin under Plugins, or with `wp plugin get ultimate-addons-for-gutenberg --field=version`\n- Compare against the affected range: versions through `2.20.5`","fix":"- Spectra (ultimate-addons-for-gutenberg): a fixed version is not stated in the sources; affected through `2.20.5`","status":"open","published_at":"2026-11-13T14:17:53+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:24+00:00","updated_at":"2026-11-13T15:21:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:21:24Z","model":"claude-haiku-5-5","output":{"fix":"- Spectra (ultimate-addons-for-gutenberg): a fixed version is not stated in the sources; affected through `2.20.5`","reach":"network","title":"Spectra WordPress block plugin: stored XSS through 2.20.5","impact":"medium","summary":"Brainstorm Force's Spectra (Ultimate Addons for Gutenberg) WordPress plugin has a stored cross-site scripting flaw, where unsafe input is saved and later rendered in pages. An attacker who can get script into stored content can run it in other visitors' browsers, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","spectra","ultimate-addons-for-gutenberg","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in other users' browsers on the site","analyst_note":"Check the NVD entry and the Wordfence or WordPress plugin page for the fixed version and the required privilege level.","how_to_check":"- Check the installed Spectra plugin version in the WordPress admin under Plugins, or with `wp plugin get ultimate-addons-for-gutenberg --field=version`\n- Compare against the affected range: versions through `2.20.5`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-2.20.5"],"who_is_affected":"Sites running the Spectra (Ultimate Addons for Gutenberg) WordPress plugin at version 2.20.5 or earlier. Exploitation needs the ability to store input the plugin renders, so sites where only trusted editors write content carry less risk. Sites without the plugin are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000773,"input_tokens":4555,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125800':11A,14A '-2026':10A,13A '2.20.5':8A,103C 'addon':22B,31B,91C 'administr':71B 'affect':98C 'allow':94C 'attack':55B 'block':3A 'brainstorm':26B,86C 'browser':69B 'content':62B 'cross':40B,81C 'cross-sit':39B,80C 'cve':9A,12A 'flaw':43B 'forc':27B,87C 'generat':79C 'get':58B 'gutenberg':24B,33B,93C 'host':18B 'improp':72C 'includ':70B 'input':46B,75C 'issu':97C 'later':50B 'n/a':101C 'neutral':73C 'packag':15B 'page':53B,78C 'plugin':4A,35B 'render':51B 'run':64B 'save':48B 'script':42B,59B,83C 'self':17B 'self-host':16B 'site':41B,82C 'spectra':1A,19B,29B,88C,99C 'store':5A,38B,61B,95C 'ultim':21B,30B,90C 'ultimate-addons-for-gutenberg':20B,89C 'unsaf':45B 'visitor':68B 'vulner':84C 'web':77C 'wordpress':2A,25B,34B 'xss':6A 'xss.this':96C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Spectra (Ultimate Addons for Gutenberg) WordPress plugin at version 2.20.5 or earlier. Exploitation needs the ability to store input the plugin renders, so sites where only trusted editors write content carry less risk. Sites without the plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","spectra","ultimateaddonsforgutenberg","wordpress"],"campaign_type":null,"search_a":"'-125800':11A,14A '-2026':10A,13A '2.20.5':8A 'block':3A 'cve':9A,12A 'plugin':4A 'spectra':1A 'store':5A 'wordpress':2A 'xss':6A","search_b":"'addon':22B,31B 'administr':71B 'attack':55B 'brainstorm':26B 'browser':69B 'content':62B 'cross':40B 'cross-sit':39B 'flaw':43B 'forc':27B 'get':58B 'gutenberg':24B,33B 'host':18B 'includ':70B 'input':46B 'later':50B 'packag':15B 'page':53B 'plugin':35B 'render':51B 'run':64B 'save':48B 'script':42B,59B 'self':17B 'self-host':16B 'site':41B 'spectra':19B,29B 'store':38B,61B 'ultim':21B,30B 'ultimate-addons-for-gutenberg':20B 'unsaf':45B 'visitor':68B 'wordpress':25B,34B","search_c":"'2.20.5':103C 'addon':91C 'affect':98C 'allow':94C 'brainstorm':86C 'cross':81C 'cross-sit':80C 'forc':87C 'generat':79C 'gutenberg':93C 'improp':72C 'input':75C 'issu':97C 'n/a':101C 'neutral':73C 'page':78C 'script':83C 'site':82C 'spectra':88C,99C 'store':95C 'ultim':90C 'ultimate-addons-for-gutenberg':89C 'vulner':84C 'web':77C 'xss.this':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125800","severity":null,"published_at":"2026-11-13T14:17:53+00:00","modified_at":"2026-11-13T14:17:53+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}