Spectra Gutenberg Blocks CVE-2026-12900

Exploitation requires an authenticated WordPress session with at minimum Contributor-level role, which is the lowest role that can create and save posts containing Gutenberg blocks. The attacker must be able to publish or at least save a draft page or post containing the uagb/image block; editor or admin review workflows that prevent Contributors from publishing would delay but not block the attack (a saved draft reviewed by an admin with the block rendered in preview is sufficient). Exploitation is limited to WordPress installations running the Spectra Legacy - Gutenberg Blocks plugin in versions through 2.19.28 with the uagb/image block available. Sites that disable Contributor-level registration, restrict block availability, or require admin approval before any block content is rendered to public visitors substantially reduce their exposure. No special server-side configuration or non-default WordPress setting is required beyond the plugin being active.

The official CVSS 3.1 score of 6.4 (Medium) reflects a network-accessible, low-complexity flaw requiring only low privileges (PR:L, Contributor level) with a scope change. The EPSS score and KEV status are absent from available data, meaning neither automated exploitation probability nor confirmed in-the-wild abuse can be stated. The real-world priority is moderate: the Contributor role is a genuine barrier on tightly managed sites but a trivial threshold on open-registration blogs, editorial platforms, or sites with compromised contributor credentials. The stored nature of the XSS elevates impact over reflected variants - a single injection can silently target all visitors and administrators, enabling session hijacking, credential phishing overlays, or admin-level actions via CSRF chaining. The low C:L/I:L CVSS impact metrics may understate the true blast radius if an administrative session is hijacked. No EPSS data was provided, so exploitation probability cannot be quantified; however, the low access barrier and large install base make this a credible opportunistic target. No POC has been identified, which reduces but does not eliminate near-term exploitation risk.

An attacker registers or compromises a Contributor-level WordPress account on a target site, then edits or creates a post inserting a uagb/image block with a crafted attribute containing a JavaScript payload. Once the post is published or saved in draft and later viewed, every site visitor - including administrators - automatically executes the attacker's script in their browser, enabling session cookie theft or forced admin actions. No public POC has been identified, but the attack primitive is well-understood and trivially constructable by any experienced web attacker.