Spectra Vulnerability – WordPress Gutenberg Blocks – Authenticated Cross-Site Scripting via Custom CSS – CVE-2023-6486 | WordPress Plugin Vulnerability Report

Plugin Name: Spectra – WordPress Gutenberg Blocks

Key Information

  • Software Type: Plugin
  • Software Slug: ultimate-addons-for-gutenberg
  • Software Status: Active
  • Software Author: brainstormforce
  • Software Downloads: 20,112,321
  • Active Installs: 600,000
  • Last Updated: April 3, 2024
  • Patched Versions: 2.10.4
  • Affected Versions: <= 2.10.3

Vulnerability Details

  • Name: Spectra – WordPress Gutenberg Blocks <= 2.10.3
  • Title: Authenticated(Contributor+) Cross-Site Scripting via Custom CSS
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2023-6486
  • CVSS Score: 6.4
  • Publicly Published: April 3, 2024
  • Researcher: Akbar Kustirama
  • Description: The Spectra plugin, a popular enhancement for the Gutenberg editor, has been identified with a vulnerability allowing authenticated users with contributor access to inject harmful scripts through the Custom CSS metabox. This Stored Cross-Site Scripting (XSS) issue, present in all versions up to 2.10.3, arises from inadequate input sanitization and output escaping, posing risks of unauthorized script execution upon page visits.


The vulnerability in the Spectra – WordPress Gutenberg Blocks plugin highlights a significant risk in versions up to 2.10.3. Authenticated users with contributor-level permissions could exploit insufficiently secured Custom CSS metaboxes to perform XSS attacks. This flaw has been remedied in version 2.10.4, underlining the importance of keeping WordPress environments updated.

Detailed Overview

Akbar Kustirama discovered this XSS vulnerability, which underscores the persistent need for rigorous security measures in plugin development. Given the widespread usage of the Spectra plugin, the potential impact of this vulnerability could be extensive, affecting numerous WordPress sites. The update to version 2.10.4 addresses this concern, preventing the injection and execution of malicious scripts.

Advice for Users

  • Immediate Action: Update the Spectra plugin to version 2.10.4 immediately to close the security gap introduced by CVE-2023-6486.
  • Check for Signs of Vulnerability: Regularly review your site for indications of exploitation, particularly in relation to Custom CSS functionalities.
  • Alternate Plugins: While the vulnerability has been patched, exploring alternatives can provide an additional layer of security and functionality.
  • Stay Updated: Consistently updating all WordPress plugins and themes is crucial for maintaining a secure and functional website.


The swift resolution of CVE-2023-6486 by Spectra’s development team reinforces the critical nature of maintaining up-to-date plugins within the WordPress ecosystem. For website owners, particularly those managing small businesses, the incident serves as a reminder of the importance of vigilant software management. In a digital landscape where vulnerabilities are inevitable, proactive security practices are key to safeguarding online assets.


Detailed Report: 


In the digital landscape where WordPress powers a significant portion of the web, plugin vulnerabilities pose substantial risks to site security. A recent discovery in the "Spectra – WordPress Gutenberg Blocks" plugin highlights the ongoing challenge of maintaining secure environments. This report delves into CVE-2023-6486, a vulnerability that underscores the critical need for regular updates and vigilance in the WordPress ecosystem.

About Spectra Plugin

Spectra – WordPress Gutenberg Blocks, formerly known as WooLentor, is a popular plugin developed by Brainstorm Force. It extends the Gutenberg editor with additional blocks and features, empowering users to enhance their website's functionality and design. With over 20 million downloads and 600,000 active installs, its widespread use makes any vulnerability a concern for a broad user base.

Risks and Impacts

The vulnerability presents a clear risk to website integrity and user data security. Stored XSS attacks can result in unauthorized script execution, compromising both site functionality and the privacy of unsuspecting visitors. Given Spectra's extensive user base, the potential impact is significant.


The developers have promptly addressed CVE-2023-6486 in version 2.10.4. Users are urged to update to this latest version to mitigate the vulnerability. Additionally, monitoring for unusual site activities can help in identifying any potential exploitation attempts.

Historical Vulnerabilities

With 13 vulnerabilities recorded since March 30, 2020, Spectra's security history emphasizes the importance of continuous vigilance and timely updates to safeguard against emerging threats.


The quick resolution of the XSS vulnerability in the Spectra plugin by Brainstorm Force is commendable. However, it serves as a crucial reminder to WordPress site owners, especially small business owners juggling various responsibilities, of the importance of maintaining an updated and secure digital presence. In a realm where cyber threats are constantly evolving, the security of your WordPress site hinges on proactive practices and informed decisions. Staying atop plugin updates, exploring secure alternatives, and adhering to best security practices are indispensable steps in fortifying your online assets against potential vulnerabilities.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Spectra Vulnerability – WordPress Gutenberg Blocks – Authenticated Cross-Site Scripting via Custom CSS – CVE-2023-6486 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment