The Spectra – WordPress Gutenberg Blocks plugin contains a stored Cross‑Site Scripting flaw caused by insufficient input sanitization and output escaping in the "uagb" block. An authenticated user with Contributor level or better can inject malicious script that is persisted in the post and executed automatically whenever any site visitor loads the page.

The vulnerability affects the Spectra Gutenberg Blocks plugin from brainstormforce. All released versions up to and including 2.19.0 are susceptible; sites running any such version are at risk.

With a CVSS score of 6.4 the flaw is classified as moderate. The EPSS score indicates a very low exploitation probability (<1%) and the issue is not listed in CISA’s KEV catalog. However, because an attacker must authenticate with Contributor or higher, the attack surface is limited to trusted users. Once an attacker injects code, it can be executed by all visitors to the affected page, potentially leading to defacement, phishing, or malicious content delivery. The moderate severity, combined with the requirement for authenticated access, means the risk is lower than high‑severity server‑side flaws, but the impact on audience interaction and brand reputation remains significant.