CVE-2025-11162
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Spectra Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS field in all versions up to and including 2.19.14 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the injected page.
Risk Assessment
An attacker with a Contributor account can inject malicious JavaScript that executes in the browser of an administrator or other users, potentially leading to session theft or account takeover. The risk applies to sites with multiple authors or open registration.
Recommendation
Update the Spectra Gutenberg Blocks plugin to a version later than 2.19.14. If updating is not possible, restrict Contributor permissions and enable content filtering.
Other vulnerabilities in Spectra Gutenberg Blocks
See all- CVE-2026-12900Medium
The Spectra Gutenberg Blocks plugin for WordPress up to version 2.19.28 is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
- CVE-2026-7465High
A vulnerability in the Spectra Gutenberg Blocks plugin for WordPress up to version 2.19.25 allows authenticated attackers with Contributor-level access and above to execute remote code on the server via a two-block payload in post content.
Original NVD description (English source)
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS