VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Spectra Legacy – Gutenberg Blocks security & vulnerabilities

ultimate-addons-for-gutenberg— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 33 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
33Known vulnerabilities
  • Critical0
  • High2
  • Medium31
  • Low0
Vulnerabilities per year
2020: 1 vulnerability1202022: 1 vulnerability1222023: 12 vulnerabilities12232024: 8 vulnerabilities8242025: 2 vulnerabilities2252026: 9 vulnerabilities926

All Spectra Legacy – Gutenberg Blocks vulnerabilities

Spectra Legacy – Gutenberg Blocks vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.20.4Update to 2.20.5
CVE-2026-119520
Medium6.5Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
≤2.20.4Update to 2.20.5
CVE-2026-92294
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
≤2.20.0Update to 2.20.1
CVE-2026-16302
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block
≤2.19.28Update to 2.19.29
CVE-2026-12900
Medium4.3Authenticated (Contributor+) CSS Injection
<2.20.0Update to 2.20.0
CVE-2026-10827
High8.8Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
≤2.19.25Update to 2.19.26
CVE-2026-7465
Medium4.3Missing Authorization
≤2.19.22Update to 2.19.23
CVE-2026-42648
Medium5.3Unauthenticated Information Disclosure in Sensitive Data
≤2.19.17Update to 2.19.18
CVE-2026-0950
Medium5.3Missing Authorization
≤2.19.17Update to 2.19.18
CVE-2026-24982
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS
≤2.19.14Update to 2.19.15
CVE-2025-11162
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.19.0Update to 2.19.1
CVE-2025-1784
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget
≤2.16.2Update to 2.16.3
CVE-2024-10484
Medium6.4Authenticated (Contributor+) Stored Cross-site Scripting
≤2.15.0Update to 2.15.1
CVE-2024-7590
Medium4.3Missing Authorization via generate_ai_content
≤2.13.7Update to 2.13.8
CVE-2024-37517
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤2.13.0Update to 2.13.1
CVE-2024-4366
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block
≤2.12.8Update to 2.12.9
CVE-2024-1815
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block
≤2.12.8Update to 2.12.9
CVE-2024-1814
Medium4.3Authenticated (Contributor+) Path Traversal
≤2.12.6Update to 2.12.7
CVE-2024-3107
Medium6.4Authenticated(Contributor+) Cross-Site Scripting via Custom CSS
≤2.10.3Update to 2.10.4
CVE-2023-6486
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.9Update to 2.7.10
CVE-2023-49833
High8.5Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms
≤2.6.6Update to 2.6.7
CVE-2023-36679
Medium4.3Missing Authorization
≤2.6.6Update to 2.6.7
CVE-2023-36676
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery in template_importer
≤2.6.6Update to 2.6.7
—
Medium6.3Cross-Site Request Forgery to Plugin Activation
≤2.3.1Update to 2.3.2
CVE-2023-23834
Medium6.3Missing Authorization Checks
≤2.3.1Update to 2.3.2
—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.14.11Update to 1.15.0
CVE-2020-36656
Medium6.5HTML Injection in Emails
≤2.3.1Update to 2.3.2
CVE-2023-23735
Medium5.4Cross-Site Request Forgery to WPForm/Blocks Import
≤2.3.1Update to 2.3.2
CVE-2023-23825
Medium5.4Missing Authorization to Captcha Setting Update
≤2.3.1Update to 2.3.2
CVE-2023-23729
Medium5.3Email Spoofing
≤2.3.1Update to 2.3.2
CVE-2023-23738
Medium5.3Captcha Bypass
≤2.3.1Update to 2.3.2
CVE-2023-23730
Medium6.1Reflected Cross-Site Scripting
≤1.25.5Update to 1.25.6
—
Medium5.5Missing Authorization
≤1.14.7Update to 1.14.8
CVE-2020-36702

Spectra Legacy – Gutenberg Blocks: common questions

Does Spectra Legacy – Gutenberg Blocks have known vulnerabilities?

Yes. VulnCrest Radar lists 33 known vulnerabilities in Spectra Legacy – Gutenberg Blocks: 2 high, 31 medium. None are known to affect version null.

How do I check which version of Spectra Legacy – Gutenberg Blocks I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Spectra Legacy – Gutenberg Blocks vulnerability?

CVE-2026-119520, published Nov 7, 2026: Spectra Legacy – Gutenberg Blocks <= 2.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Spectra Legacy – Gutenberg Blocks vulnerability listed in CISA KEV?

No. None of the known Spectra Legacy – Gutenberg Blocks vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?