Security Alert Summary
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the uagb/image block. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject scripts into pages; those scripts execute whenever a user views an injected page.
CVE Details
- CVE ID: CVE-2026-12900
- Affected plugin/component: Spectra Gutenberg Blocks – Website Builder for the Block Editor (uagb/image block)
- Affected versions: All versions up to and including 2.19.28
- Published: July 20, 2026 at 10:17:13 PM UTC
- Last modified: July 20, 2026 at 10:17:13 PM UTC
- CVSS v3.1: Base Score 6.4, Medium —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Attacker must be authenticated with low privileges (Privileges Required: Low). No user interaction required (User Interaction: None).
- Attack vector / complexity / scope: Network, Low complexity, Scope: Changed
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This vulnerability is a stored cross-site scripting issue in the plugin’s uagb/image block. Due to insufficient input sanitization and missing or incomplete output escaping, an authenticated user with Contributor-level access or higher can inject arbitrary web scripts into page content handled by that block. When another user loads the affected page, the injected script can execute in the context of the victim’s browser.
The underlying cause is the failure to properly sanitize and escape user-supplied data associated with the image block before storing or rendering it. The CVE description specifically identifies the uagb/image block and notes insufficient input sanitization and output escaping as the root issue.
Impact is limited to what can be achieved via injected client-side scripts. The exploit allows actions that an in-browser script can perform against users who view the injected page, consistent with the CVSS rating of low confidentiality and integrity impact and no availability impact.
How This Could Impact Your Website
Consider a site with a site owner, internal staff members who publish content, and external contributors or contractors who have Contributor-level access. A contributor could add a crafted payload through the vulnerable image block while editing a page. When internal staff or site visitors open that page, the payload could execute in their browsers.
Practical consequences include exposure of data accessible to the victim’s browser (for example, session-revealed identifiers or UI-displayed emails), and an increased risk of targeted phishing or social engineering against staff whose browsers execute the injected script. The issue does not, based on the provided data, indicate direct full-site takeover or availability loss, but it does raise risks to user privacy and trust.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor-level access for external users.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior or unexpected content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.28/blocks-config/image/class-uagb-image.php#L59
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.28/includes/blocks/image/block.php#L10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9dc5e3-9d72-4c04-8ba9-56428a6fdddd?source=cve
