What’s Vulnerable › Vulnerabilities

CVE-2020-36656: Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-21 · updated 2026-06-17
• Weakness: CWE-79

Description

The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks.

Affected products

• Brainstorm Force Spectra: before 1.15.0 — fixed in 1.15.0

How to fix

Upgrade to a fixed version: Brainstorm Force Spectra 1.15.0. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/10f7e892-7a91-4292-b03e-6ad75756488b
• https://wpscan.com/vulnerability/10f7e892-7a91-4292-b03e-6ad75756488b

Get alerted when CVE-2020-36656 or the next vulnerability affects your stack