Spectra Legacy Gutenberg Blocks
Monthly
Unauthenticated attackers can delete theme files from WordPress sites running the Spectra Gutenberg Blocks (Ultimate Addons for Gutenberg) plugin in any version up to and including 2.20.4, because the plugin's '__construct' routine in its FSE fonts compatibility class does not adequately validate file paths before a deletion operation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L, score 6.5) confirms the endpoint is reachable remotely with no credentials and no user interaction, but impact is deliberately limited: the flaw is described as 'limited file deletion' confined to theme files, so it does not enable arbitrary file deletion, code execution or data disclosure - damage is site breakage or defacement. No CISA KEV listing and no confirmed public exploit code were supplied at time of analysis, and the Wordfence-sourced decision label places this at 'this_month' rather than an emergency: a genuine but mid-tier priority.
Authenticated WordPress users holding Contributor-level access or higher can retrieve administrator-configured Instagram Graph API access tokens from any site running the Spectra Legacy - Gutenberg Blocks plugin at version 2.20.0 or earlier, because the plugin's editor_assets function injects the uag_insta_linked_accounts option into the uagb_blocks_info JavaScript object without performing a capability check. The exposure is gated on a specific deployment state: the separate Spectra Pro plugin must be active and an administrator must already have linked an Instagram account, so sites without that integration have no token to leak and are not meaningfully at risk. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200), this is a real but low-impact, configuration-dependent information disclosure; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Stored Cross-Site Scripting in the Spectra Legacy - Gutenberg Blocks plugin for WordPress (all versions through 2.19.28) allows low-privileged authenticated attackers to plant persistent malicious scripts via the image block that execute in any visitor's browser. The vulnerability resides in insufficient sanitization and output escaping within the `uagb/image` block renderer, specifically traced by Wordfence to `class-uagb-image.php` and `block.php`. With Contributor-level access - a role available on virtually any multi-author or membership-enabled WordPress site - an attacker can inject payloads that persist until removed, affecting every subsequent visitor. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated attackers can delete theme files from WordPress sites running the Spectra Gutenberg Blocks (Ultimate Addons for Gutenberg) plugin in any version up to and including 2.20.4, because the plugin's '__construct' routine in its FSE fonts compatibility class does not adequately validate file paths before a deletion operation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L, score 6.5) confirms the endpoint is reachable remotely with no credentials and no user interaction, but impact is deliberately limited: the flaw is described as 'limited file deletion' confined to theme files, so it does not enable arbitrary file deletion, code execution or data disclosure - damage is site breakage or defacement. No CISA KEV listing and no confirmed public exploit code were supplied at time of analysis, and the Wordfence-sourced decision label places this at 'this_month' rather than an emergency: a genuine but mid-tier priority.
Authenticated WordPress users holding Contributor-level access or higher can retrieve administrator-configured Instagram Graph API access tokens from any site running the Spectra Legacy - Gutenberg Blocks plugin at version 2.20.0 or earlier, because the plugin's editor_assets function injects the uag_insta_linked_accounts option into the uagb_blocks_info JavaScript object without performing a capability check. The exposure is gated on a specific deployment state: the separate Spectra Pro plugin must be active and an administrator must already have linked an Instagram account, so sites without that integration have no token to leak and are not meaningfully at risk. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200), this is a real but low-impact, configuration-dependent information disclosure; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Stored Cross-Site Scripting in the Spectra Legacy - Gutenberg Blocks plugin for WordPress (all versions through 2.19.28) allows low-privileged authenticated attackers to plant persistent malicious scripts via the image block that execute in any visitor's browser. The vulnerability resides in insufficient sanitization and output escaping within the `uagb/image` block renderer, specifically traced by Wordfence to `class-uagb-image.php` and `block.php`. With Contributor-level access - a role available on virtually any multi-author or membership-enabled WordPress site - an attacker can inject payloads that persist until removed, affecting every subsequent visitor. No public exploit code or CISA KEV listing has been identified at time of analysis.