CVE-2026-10827 describes a vulnerability in the Spectra Legacy WordPress plugin prior to version 2.20.0. The plugin fails to validate or escape several block style attributes before incorporating them into CSS output on the front end. Users with Contributor role or above can exploit this to inject arbitrary CSS into affected pages. The CSS injection can lead to forced external resource loading, page defacement or redressing, and data exfiltration via CSS attribute selectors. JavaScript injection is prevented by KSES filtering, so the impact is limited to CSS injection. No official remediation or patch information is provided in the available data.

The vulnerability allows low-privileged users (Contributor role and above) to inject arbitrary CSS into pages viewed by anonymous visitors. This can result in forced loading of external resources, visual defacement or alteration of page content, and potential data exfiltration through CSS selectors. However, the inability to execute JavaScript limits the severity and scope of potential attacks. The CVSS score of 3.5 reflects a low severity impact with limited confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role permissions where possible and monitor for suspicious CSS injection attempts. Since JavaScript execution is blocked, the risk is limited to CSS injection effects.