Spectra Legacy – Gutenberg Blocks
Spectra Legacy – Gutenberg Blocks has 30 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 30 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2023 was the busiest year with 12 disclosures.
The most common weakness is Cross-Site Scripting, behind 12 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 30 issues recorded for Spectra Legacy – Gutenberg Blocks has a vendor fix available, so running the current release closes all known holes.
18 independent researchers contributed these findings, most of them (4) reported by Dave Jong. Spectra Legacy – Gutenberg Blocks is installed on roughly 1,000,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-7465Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
Read the full analysisVulnerability Records

Spectra Legacy – Gutenberg Blocks
Author
Brainstorm Force
This plugin was previously called Spectra. It’s now Spectra Legacy. Nothing on your website has changed. Your blocks, pages, settings, and content all continue to work exactly as they did before. There’s nothing to migrate and nothing to configure. Spectra Legacy vs. Spectra Blocks We’ve split Spectra into two products. Spectra Legacy is this plugin — built for existing Spectra users. It receives security and compatibility updates and full support, but no new features. Spectra Blocks is a new, separate plugin where all new feature development happens, aimed at new installs and anyone who wants ongoing additions. If you’re already using this plugin, no action is needed; installing Spectra Blocks is entirely optional whenever you’re ready. If you’re already using this plugin, you don’t need to do anything. If you want new features as they’re released, you can install Spectra Blocks separately, whenever you’re ready. There’s no deadline and no required migration. What’s included Spectra Legacy includes the full block library your site is already built on: layout tools, content and post blocks, form and SEO blocks, social blocks, and site tools like Popup Builder and Coming Soon mode. Blocks included Core — Container, Heading, Image, Icon, Buttons, Info Box, Call To Action, Countdown Content — Sliders, Content Timeline, Google Maps, Inline Notices, Tabs, Taxonomy List, Price List (Loop Builder in Spectra Pro Legacy) Post — Counter, Modal Popup, Post Carousel, Post Grid, Post Timeline Social — Instagram Feed, Blockquote, Social Share, Team, Testimonials Forms — Contact form, newsletter signup, suggestion form, reCAPTCHA (registration/login forms in Spectra Pro Legacy) SEO — FAQ, How-To, Review, Table of Contents Dynamic content — Archive feed filtering by date, author, category, and post type Site tools — Popup Builder, Coming Soon mode, block animations, local Google Fonts, global styling defaults About the AI block The AI block previously included in this plugin is now called ZipAI. It still works in Spectra Legacy for compatibility. New AI features are being built in Spectra Blocks going forward. Compatibility Works with most standard WordPress themes, including Spectra One, Astra, Blocksy, and GeneratePress. Compatible with common plugins including WooCommerce, SureCart, Gravity Forms, LearnDash, MemberPress, and Yoast SEO. See our documentation for the full compatibility list. Support & community Spectra Legacy is actively maintained — security patches, compatibility updates, and support all continue. This plugin is not deprecated. Support forum: use the Support tab on this page Documentation: wpspectra.com/docs Facebook Group: Web Creators by Astra Facebook: Spectra X (Twitter): @wpspectra Contribute Spectra is open source. Browse the code or contribute on GitHub: brainstormforce/wp-spectra Credits Our external packages use Rating Star Component that are distributed under the terms of the ISC. While Slick, Lottie and Striptags is distributed under the terms of the MIT. Additionally, we incorporate FontAwesome v6 under the CC BY 4.0 License, and dnd kit licensed under the MIT License.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C