CVE-2025-1784

Summary

CVE-2025-1784 is a Stored Cross-Site Scripting vulnerability affecting the Spectra – WordPress Gutenberg Blocks plugin. The issue, present in versions up to 2.19.0, permits authenticated attackers with Contributor-level access or higher to inject malicious scripts into the uagb block. These scripts will execute whenever a user visits an injected page. Due to insufficient input sanitization and output escaping, the vulnerability poses a significant risk to WordPress sites using this plugin. It is strongly recommended that users update to the latest version of the plugin to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.