Spectra Legacy – Gutenberg Blocks

88 Quality Score

Active Installs

27/30

One million active installs confirms extremely wide adoption across the WordPress ecosystem, reflecting its role as the default legacy companion for UAG users.

Update Freshness

25/25

A perfect maintenance score, with a release dated July 2026 and a tested-against-WordPress 7.0.1 stamp, indicates the developer is actively keeping it secure and current.

User Rating

14/15

A 94 out of 100 across 1,869 reviews is a strong endorsement from a sizeable user base, well above typical block plugin averages.

Support Health

7/15

With 12 of 13 support threads resolved, an effective rate of 92.3%, users reporting issues are getting timely help.

WP Compatibility

15/15

Full marks for compatibility, validated against WordPress 7.0.1, requiring only PHP 7.4 and WordPress 5.6, so it runs on the vast majority of hosts.

Scores higher than 98% of indexed plugins

About

Gutenberg blocks for existing Spectra websites. Maintained, stable, and fully supported — no action needed on your part.

Active Installs 1M+

Rating ★★★★½ 4.7/5

Last Updated 2026-08-26 12:07pm GMT

Requires WordPress 5.6+

Tested Up To 7.1

Requires PHP 7.4+

Security History

31 known vulnerabilities, all patched

2 High 29 Medium

Most recent: September 23, 2026

View details ▸

Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure Medium

September 23, 2026 Patched in ["2.20.1"] CVE-2026-16302

Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block Medium

July 20, 2026 Patched in ["2.19.29"] CVE-2026-12900

Spectra Legacy – Gutenberg Blocks < 2.20.0 - Authenticated (Contributor+) CSS Injection Medium

July 20, 2026 Patched in ["2.20.0"] CVE-2026-10827

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes High

May 29, 2026 Patched in ["2.19.26"] CVE-2026-7465

Spectra <= 2.19.22 - Missing Authorization Medium

March 27, 2026 Patched in ["2.19.23"] CVE-2026-42648

Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data Medium

February 2, 2026 Patched in ["2.19.18"] CVE-2026-0950

Spectra <= 2.19.17 - Missing Authorization Medium

January 17, 2026 Patched in ["2.19.18"] CVE-2026-24982

Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS Medium

November 4, 2025 Patched in ["2.19.15"] CVE-2025-11162

Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

March 25, 2025 Patched in ["2.19.1"] CVE-2025-1784

Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget Medium

December 2, 2024 Patched in ["2.16.3"] CVE-2024-10484

Spectra – WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-site Scripting Medium

August 7, 2024 Patched in ["2.15.1"] CVE-2024-7590

Spectra <= 2.13.7 - Missing Authorization via generate_ai_content Medium

July 5, 2024 Patched in ["2.13.8"] CVE-2024-37517

Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting Medium

May 23, 2024 Patched in ["2.13.1"] CVE-2024-4366

Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block Medium

May 22, 2024 Patched in ["2.12.9"] CVE-2024-1815

Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block Medium

May 22, 2024 Patched in ["2.12.9"] CVE-2024-1814

Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal Medium

April 26, 2024 Patched in ["2.12.7"] CVE-2024-3107

Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS Medium

April 3, 2024 Patched in ["2.10.4"] CVE-2023-6486

Spectra <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

December 5, 2023 Patched in ["2.7.10"] CVE-2023-49833

Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms High

July 14, 2023 Patched in ["2.6.7"] CVE-2023-36679

Spectra <= 2.6.6 - Missing Authorization Medium

July 14, 2023 Patched in ["2.6.7"] CVE-2023-36676

Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in template_importer Medium

July 14, 2023 Patched in ["2.6.7"]

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to Plugin Activation Medium

January 25, 2023 Patched in ["2.3.2"] CVE-2023-23834

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks Medium

January 25, 2023 Patched in ["2.3.2"]

Spectra – WordPress Gutenberg Blocks <= 1.14.11 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

January 24, 2023 Patched in ["1.15.0"] CVE-2020-36656

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import Medium

January 23, 2023 Patched in ["2.3.2"] CVE-2023-23825

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization to Captcha Setting Update Medium

January 23, 2023 Patched in ["2.3.2"] CVE-2023-23729

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - HTML Injection in Emails Medium

January 23, 2023 Patched in ["2.3.2"] CVE-2023-23735

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Email Spoofing Medium

January 23, 2023 Patched in ["2.3.2"] CVE-2023-23738

Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Captcha Bypass Medium

January 23, 2023 Patched in ["2.3.2"] CVE-2023-23730

Spectra – WordPress Gutenberg Blocks <= 1.25.5 - Reflected Cross-Site Scripting Medium

May 31, 2022 Patched in ["1.25.6"]

Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization Medium

March 30, 2020 Patched in ["1.14.8"] CVE-2020-36702

What It Does

Spectra Legacy is a compatibility shim that keeps Gutenberg block functionality active for sites originally built with the older Ultimate Addons for Gutenberg (UAG) plugin. It preserves layouts, patterns, and custom block configurations without forcing existing users onto the newer Spectra 2.x product. In practical terms it lets long-time UAG users continue editing without seeing broken blocks or content loss.

Who It's For

This is built for site owners who already use older Ultimate Addons for Gutenberg blocks on production sites and want continued stability without redesigning their content. It suits agencies and businesses running legacy UAG-powered pages who are not ready to migrate to Spectra 2 or rebuild with a different page builder. Freelancers maintaining client builds from before the rebrand will also benefit from the stability it provides.

Who Should Skip It

New sites or anyone building fresh Gutenberg layouts should skip this and install Spectra 2 directly, or pick Kadence Blocks if they want a modern block toolkit. If you have already migrated fully off legacy UAG blocks, this plugin is unnecessary overhead.

The Bottom Line

Spectra Legacy scores 94.82 out of 100 and serves a narrow but important job: keeping legacy UAG block content rendering reliably. It is not a feature-rich toolkit or a creative design tool, it is a maintenance and compatibility layer. For the exact audience it targets, existing UAG users, it does the job very well.

Related Plugins

Elementor Website Builder 95/100

Pick Elementor when you want a full front-end page builder with deep design controls rather than sticking with native Gutenberg blocks.

Kadence Blocks 89/100

Choose Kadence if you are building new Gutenberg sites and want a modern block library with strong template controls.

Starter Templates 89/100

Go with Starter Templates if you need ready-made full-site starter designs for either Gutenberg or Elementor and want to skip layout work.

Classic Widgets 89/100

Pick Classic Widgets if your concern is restoring the old widget screen, not preserving any block content at all.

PublishPress Blocks 88/100

Choose PublishPress Blocks if you need editorial block controls such as visibility rules and role-based block permissions on top of the default editor.