CVE-2026-12900

Name of the Vulnerable Software and Affected Versions Spectra Gutenberg Blocks – Website Builder for the Block Editor versions prior to 2.19.29

Description Stored Cross-Site Scripting occurs via the uagb/image block due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 2.19.28.