EUVD-2026-51696
GHSA-jjxc-6f47-pv8f
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Contributor is a low-privilege WordPress role warranting PR:L not PR:H; page visit by victim required (UI:R); CSS-only impact caps C and I at Low with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.
AnalysisAI
CSS injection in the Spectra Legacy WordPress plugin before version 2.20.0 allows authenticated Contributors to embed arbitrary CSS via unvalidated block style attributes that are output verbatim to page front-ends. Anonymous visitors loading affected pages are exposed to attacker-controlled styles enabling page defacement, UI redressing, external resource loading, and side-channel data exfiltration through CSS attribute selectors. JavaScript execution is explicitly blocked by WordPress KSES filtering, constraining the worst-case impact; a publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.12% (2nd percentile), indicating low observed exploitation probability and no CISA KEV listing.
Technical ContextAI
The affected component is the Spectra Legacy WordPress plugin (CPE: cpe:2.3:a:unknown:spectra_legacy:*:*:*:*:*:*:*:*), a Gutenberg block builder. The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity), which in this context manifests as a failure to validate or escape contributor-supplied block style attributes before interpolating them into inline CSS emitted on the public-facing front-end. WordPress's KSES (K-sanitization) system strips script tags at save time, which prevents JavaScript breakout from this vector but does not govern raw CSS attribute values passed through the block editor. CSS attribute selectors (e.g., input[value^='x']) can be weaponized to probe DOM attribute content and trigger external HTTP requests, enabling passive data leakage without any JavaScript. The Gutenberg block editor separates content authoring from rendering in a way that, if output encoding is omitted at the CSS generation step, allows contributed style data to survive unmodified into server-rendered HTML.
RemediationAI
Update the Spectra Legacy WordPress plugin to version 2.20.0 or later, which introduces proper validation and escaping of block style attributes prior to CSS output; this is confirmed as the vendor-released fix per WPScan (https://wpscan.com/vulnerability/068ac525-423b-42f8-9ef4-f102f948dc78/). Where immediate patching is not feasible, restrict the Contributor role from creating or publishing posts that include Spectra Legacy blocks, or enforce editorial approval workflows so that Contributor-submitted content is reviewed before publication - this eliminates the attack surface without requiring the update. Deploying a Content Security Policy (CSP) header with a restrictive default-src or style-src directive can block CSS-triggered external resource loads, limiting data exfiltration via external HTTP requests, though it will not prevent local UI redressing or defacement. Note that CSP alone does not fix the injection and adds operational overhead when legitimate external resources are used. Removing the plugin entirely in favor of the non-legacy Spectra version is the most durable remediation if the legacy plugin is no longer required.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today