Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H R U L L N 3.5 .0011 1.3 —
AFFECTED Product Versions Fixed Spectra Legacy unspecified —
TIMELINE Jun 4 Reserved by WPScan Aug 1 Published (CNA: WPScan) Aug 4 EXPLOIT PUBLISHED — CVE-2026-10827 (Unknown Spectra Legacy). Public exploit reference added.
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.
| Date | Event | Detail |
|---|---|---|
| June 4, 2026 | Reserved | Reserved by WPScan |
| August 1, 2026 | Published | Published (CNA: WPScan) |
| August 4, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-10827 (Unknown Spectra Legacy). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | Spectra Legacy | — | — | — |
Authoritative record: CVE-2026-10827 at cve.org
Weaknesses: CWE-345
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-10827 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.