Spectra Legacy block styles let Contributors inject arbitrary CSS
Spectra Legacy before 2.20.0 uses several Contributor-controlled block style attributes to construct front-end CSS without adequate validation or escaping. A Contributor-or-higher user can store arbitrary CSS that is served to anonymous visitors of the affected page, enabling defacement, interface redressing, forced external resource loads and limited data exfiltration through attribute selectors. WordPress KSES removes the script-tag breakout at this role, so the published record does not establish JavaScript execution; it also does not disclose the affected block attributes or CSS builder.
- Component
- Spectra Legacy
- Plugin slug
spectra-legacy- Affected
- < 2.20.0
- Safe version
2.20.0- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Spectra Legacy to 2.20.0 or later. Review block styles authored by Contributors for external URLs, attribute selectors or page-redressing rules, remove confirmed payloads, and inspect external request logs if visitor data may have been transmitted.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.