The Spectra Legacy WordPress plugin builds CSS for its blocks from user‑supplied style attributes without validating or escaping them. Contributors and higher roles can craft block content that injects arbitrary CSS. This injected CSS is served to anonymous visitors, allowing attackers to deface pages, force the browser to load external resources, or exfiltrate information via CSS attribute selectors. JavaScript execution is prevented by the plugin’s use of KSES, so the attack is limited to the style layer.

All installations of Spectra Legacy that are running a version earlier than 2.20.0 are vulnerable. The weakness is triggered when users with the Contributor role or higher create or edit blocks with the plugin. No specific Windows, Linux, or OS versions are involved; the vulnerability exists only in the WordPress plugin code.

The EPSS score is below 1 %, indicating that the likelihood of exploitation is low, but the vulnerability is still feasible when an attacker gains a Contributor or higher role on a WordPress site that uses Spectra. The CVSS base score for this issue is 3.5, classifying it as low severity. The issue is not listed in the CISA KEV catalog, yet the ability to inject arbitrary CSS could enable phishing or data‑exfiltration attacks that would not be considered low‑impact by all organizations. Because the vector relies on a privileged user, the risk is elevated for sites that allow many contributors to edit content, but the lack of JavaScript execution limits the potential for remote code execution.