CVE-2026-10827
Received Received - Intake

CSS Injection in Spectra Legacy WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-10827
EUVD
EUVD-2026-51696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spectra spectra_legacy to 2.20.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Spectra Legacy WordPress plugin before version 2.20.0. It allows users with Contributor role or higher to inject arbitrary CSS into pages using affected blocks. The plugin does not properly validate or escape block style attributes, leading to CSS injection on front-end pages. This can cause external resource loads, page defacement, or data exfiltration via CSS selectors.

Detection Guidance

Check if the Spectra Legacy WordPress plugin version is below 2.20.0. Inspect WordPress admin pages for blocks using unvalidated CSS attributes. Review front-end page source for injected CSS styles or external resource loads.

Impact Analysis

If you use the vulnerable plugin, attackers with Contributor access could inject malicious CSS into your site. This may lead to unauthorized external resource loading, altered page appearance, or theft of sensitive data through CSS-based exfiltration techniques. Visitors to your site may experience defaced pages or unexpected behavior.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized data access, which may violate GDPR or HIPAA compliance. CSS injection might expose user data or allow attackers to manipulate page content to capture sensitive information. Organizations must address this to maintain regulatory compliance and protect user privacy.

Mitigation Strategies

Update the Spectra Legacy plugin to version 2.20.0 or higher immediately. Remove or restrict Contributor role access to untrusted users. Monitor front-end pages for unexpected CSS changes or external resource loads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart