Plugin security history

Spectra Legacy – Gutenberg Blocks Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 29 vulnerability records associated with Spectra Legacy – Gutenberg Blocks, published between 2020 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

29Total records

0Critical

2High

27Medium

0Low

0Informational

29Patched records

0Currently marked unpatched

2020-03-30First disclosure

2026-07-20Latest disclosure

26 of 29CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	1	1 records
2022	1	1 records
2023	12	12 records
2024	8	8 records
2025	2	2 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
High	2	6.9%
Medium	27	93.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

12 records41.4%

First: 2022. Latest: 2026.

Missing Authorization

7 records24.1%

First: 2020. Latest: 2026.

Other

5 records17.2%

First: 2023. Latest: 2023.

CSRF

2 records6.9%

First: 2023. Latest: 2023.

Path Traversal

1 record3.4%

First: 2024. Latest: 2024.

Information Disclosure

1 record3.4%

First: 2026. Latest: 2026.

Privilege Escalation

1 record3.4%

First: 2026. Latest: 2026.

Patch Status

Patched: 29
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.19.29
2.19.26
2.19.23
2.19.18
2.19.15
2.19.1
2.16.3
2.15.1
2.13.8
2.13.1
2.12.9
2.12.7
2.10.4
2.7.10
2.6.7
2.3.2
1.15.0
1.25.6
1.14.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.3.1`	Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization to Captcha Setting Update	January 23, 2023	2.3.2	Medium
`*-2.3.1`	Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import	January 23, 2023	2.3.2	Medium
`*-1.25.5`	Spectra – WordPress Gutenberg Blocks <= 1.25.5 - Reflected Cross-Site Scripting	May 31, 2022	1.25.6	Medium
`*-1.14.7`	Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization	March 30, 2020	1.14.8	Medium

Selected source records

Latest Records

MediumCVE-2026-12900

Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block

Published: July 20, 2026

Affected versions: *-2.19.28
Patched versions: 2.19.29

Original Wordfence record

HighCVE-2026-7465

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

Published: May 29, 2026

Affected versions: *-2.19.25
Patched versions: 2.19.26

Original Wordfence record

MediumCVE-2026-42648

Spectra <= 2.19.22 - Missing Authorization

Published: March 27, 2026

Affected versions: *-2.19.22
Patched versions: 2.19.23

Original Wordfence record

MediumCVE-2026-0950

Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data

Published: February 2, 2026

Affected versions: *-2.19.17
Patched versions: 2.19.18

Original Wordfence record

MediumCVE-2026-24982

Spectra <= 2.19.17 - Missing Authorization

Published: January 17, 2026

Affected versions: *-2.19.17
Patched versions: 2.19.18

Original Wordfence record

MediumCVE-2025-11162

Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS

Published: November 4, 2025

Affected versions: *-2.19.14
Patched versions: 2.19.15

Original Wordfence record

MediumCVE-2025-1784

Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 25, 2025

Affected versions: *-2.19.0
Patched versions: 2.19.1

Original Wordfence record

MediumCVE-2024-10484

Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget

Published: December 2, 2024

Affected versions: *-2.16.2
Patched versions: 2.16.3

Original Wordfence record

Highest-Severity Records

HighCVE-2026-7465

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

Published: May 29, 2026

Affected versions: *-2.19.25
Patched versions: 2.19.26

Original Wordfence record

HighCVE-2023-36679

Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms

Published: July 14, 2023

Affected versions: *-2.6.6
Patched versions: 2.6.7

Original Wordfence record

MediumCVE-2023-23735

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - HTML Injection in Emails

Published: January 23, 2023

Affected versions: *-2.3.1
Patched versions: 2.3.2

Original Wordfence record

MediumCVE-2023-49833

Spectra <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 5, 2023

Affected versions: *-2.7.9
Patched versions: 2.7.10

Original Wordfence record

MediumCVE-2026-12900

Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block

Published: July 20, 2026

Affected versions: *-2.19.28
Patched versions: 2.19.29

Original Wordfence record

MediumCVE-2024-1815

Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block

Published: May 22, 2024

Affected versions: *-2.12.8
Patched versions: 2.12.9

Original Wordfence record

MediumCVE-2025-11162

Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS

Published: November 4, 2025

Affected versions: *-2.19.14
Patched versions: 2.19.15

Original Wordfence record

MediumCVE-2024-4366

Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting

Published: May 23, 2024

Affected versions: *-2.13.0
Patched versions: 2.13.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory