The Spectra Gutenberg Blocks plugin for WordPress contains a stored XSS vulnerability (CWE-79) in its Image Gallery block due to improper neutralization of input during web page generation. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript code via user-supplied attributes that are not properly sanitized or escaped. This malicious code executes in the context of any user viewing the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all plugin versions up to 2.12.8. No known exploits are reported in the wild, and no patch or remediation details are currently available.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable Image Gallery block. These scripts execute in the browsers of users who visit the infected pages, potentially leading to unauthorized actions such as session theft or defacement. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data. The CVSS 3.1 base score is 6.4, indicating a medium severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and consider removing or disabling the Image Gallery block if feasible. Monitor official channels from brainstormforce for updates and apply patches promptly once available.