---
id: "CVE-2026-125800"
page: "https://infrastack.ai/live/CVE-2026-125800"
kind: "vulnerability"
aliases: ["CVE-2026-125800"]
title: "Spectra WordPress block plugin: stored XSS through 2.20.5"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "spectra", "ultimate-addons-for-gutenberg", "wordpress"]
not_affected_if: ["plugin-above-2.20.5", "plugin-not-installed"]
published_at: "2026-11-13T14:17:53+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125800", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# Spectra WordPress block plugin: stored XSS through 2.20.5

Link for people: https://infrastack.ai/live/CVE-2026-125800 (this .md is for agents)

Brainstorm Force's Spectra (Ultimate Addons for Gutenberg) WordPress plugin has a stored cross-site scripting flaw, where unsafe input is saved and later rendered in pages. An attacker who can get script into stored content can run it in other visitors' browsers, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Spectra plugin version in the WordPress admin under Plugins, or with `wp plugin get ultimate-addons-for-gutenberg --field=version`
- Compare against the affected range: versions through `2.20.5`

## Fix

- Spectra (ultimate-addons-for-gutenberg): a fixed version is not stated in the sources; affected through `2.20.5`

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125800

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_