CVE-2023-6486: 
NixOS vulnerability analysis and mitigation

The Spectra – WordPress Gutenberg Blocks plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2023-6486) in versions up to and including 2.10.3. The vulnerability was discovered and publicly disclosed on April 3, 2024, affecting the Custom CSS metabox functionality of the plugin (Abay Advisory, Wordfence).

The vulnerability exists due to insufficient input sanitization and output escaping in the Custom CSS metabox feature accessible via Spectra Page Settings when creating a new post. The CVSS score for this vulnerability is 6.4 (Medium) (Wordfence).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user, including administrators, accesses the compromised page (Abay Advisory).

The vulnerability can be exploited by authenticated users with contributor-level access or higher by injecting malicious scripts through the Custom CSS option in Spectra Page Settings. A proof of concept demonstrates that attackers can create a new post, access Spectra Page Settings, and insert JavaScript code in the Custom CSS field that executes when the post is viewed (Abay Advisory).