Spectra Legacy – Gutenberg Blocks

Reviewers keep praising quick, friendly support, especially from Ravi and the team, though one long-time user flagged missing blocks and no downgrade path after the V3 upgrade, and another hit a tabs-block bug on WordPress 7.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

869 searches this plugin appeared in over the last 90 days, 20 listed. 770 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 23% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2.1 years ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ arabellawatches

   4mo ago

   I am absolutely thrilled with Spectra! It is incredibly easy to use and has allowed me to build my entire WordPress website using Astra + Spectra from scratch, without having any prior knowledge of programming or web construction. But what completely blew me away was their support. I am deeply grateful for the level of involvement, efficiency, and kindness shown by the support service, specifically Ravi & the Customer Care team at Brainstorm Force. They went above and beyond to help me. Highly recommended tool for anyone looking for a clean, efficient, and professional web building experience!

   Read on wp.org ↗
2. ★★★★★ sokostas

   4mo ago

   I switched a lot of my elementor websites to spectra pro and astra. The performance is better.

   Read on wp.org ↗
3. ★★★★★ Wilf James

   4mo ago

   First time using this and had a small problem with getting this to work in my install. I opened a support ticket and received a lighting fast comprehensive reply asking for a little more detail. However my answer was in that first reply and I solved the problem. It was down to the learning curve. The product is first class and the support is first class plus.

   Read on wp.org ↗
4. ★★★★★ vince34

   4mo ago

   Thème cher et peu intéressant

   Read on wp.org ↗
5. ★★★★★ alexhuber98

   4mo ago

   After manually downgrading to V2 and not being able to upgrade to V3 again, Spectra support quickly helped me in restoring my website. All went smoothly, thank you!

   Read on wp.org ↗
6. ★★★★★ effx1863

   4mo ago

   I was evaluating new tools for our business and found the Spectra and Astra excellent!! We were testing three othe rproducts. I was able to use the free version to assign web development task to three techs who where able get up speed and create beautiful websites in record time. We had one issue with licensing and the response was unbelievably fast and professional!! The key to any great company is it’s communication and support and both are excellent! Extremely Happy and impressed!

   Read on wp.org ↗
7. ★★★★★ Paolo Cigala

   5mo ago

   Not only is it an excellent system, but it also gives you the certainty of being listened to and receiving support in case of need. Thx Ravi and all client support team

   Read on wp.org ↗
8. ★★★★★ jimk1416

   5mo ago

   Another issue and another quick knowledgeable answer from the support team. Highly recommend.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.20.0 Renamed to “Spectra Legacy”; all blocks, settings, and content remain fully intact. Fix: This update addressed a security bug. Props to Muni Nitish Kumar Yaddala and WPScan for the responsible disclosure. Fix: Info Box — 2.20.0
2. — Version 2.19.29 Fix: This update addressed a security bug. Props to Wordfence for reporting it responsibly to our team. Please make sure you are using the latest version on your website. Fix: WPML compatibility — resolved PHP error caus 2.19.29
3. — Version 2.19.28 Fix: FAQ — Existing FAQ blocks created before the apiVersion 3 update now validate correctly in the editor. Fix: Info Box CTA button colors were not applying on the frontend when “Inherit from Theme” is disabled. 2.19.28
4. — Version 2.19.27 New: Added full compatibility with WordPress 7.0 — all blocks migrated to apiVersion 3 for iframe editor support. Fix: Resolved fatal errors on WordPress.com Atomic hosting. 2.19.27
5. — Version 2.19.26 This update addressed a security bug. Props to Wordfence for reporting it responsibly to our team. Please make sure you are using the latest version on your website. Fix: Resolved a PHP warning triggered when inserting i 2.19.26
6. — Version 2.19.25 Fix: RTL support for Timeline, Testimonial, and Info Box blocks — now render correctly in right-to-left languages. 2.19.25

All 32 disclosed vulnerabilities are patched in the current version (2.20.5). Sites still on an older version should update.

1. Patched Medium · 6.5 Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters ↗
   2026-10-30 CVE-2026-92294 Missing Authorization Affects <= 2.20.4 Patched in 2.20.5
2. Patched Medium · 4.3 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure ↗
   2026-09-23 CVE-2026-16302 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.20.0 Patched in 2.20.1
3. Patched Medium · 6.4 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block ↗
   2026-07-20 CVE-2026-12900 Improper Neutralization of Input During Web Page Generation Affects <= 2.19.28 Patched in 2.19.29
4. Patched Medium · 4.3 Spectra Legacy – Gutenberg Blocks < 2.20.0 - Authenticated (Contributor+) CSS Injection ↗
   2026-07-20 CVE-2026-10827 Improper Input Validation Affects < 2.20.0 Patched in 2.20.0
5. Patched High · 8.8 Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes ↗
   2026-05-29 CVE-2026-7465 Improper Privilege Management Affects <= 2.19.25 Patched in 2.19.26
6. Patched Medium · 4.3 Spectra <= 2.19.22 - Missing Authorization ↗
   2026-03-27 CVE-2026-42648 Missing Authorization Affects <= 2.19.22 Patched in 2.19.23
7. Patched Medium · 5.3 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data ↗
   2026-02-02 CVE-2026-0950 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.19.17 Patched in 2.19.18
8. Patched Medium · 5.3 Spectra <= 2.19.17 - Missing Authorization ↗
   2026-01-17 CVE-2026-24982 Missing Authorization Affects <= 2.19.17 Patched in 2.19.18
9. Patched Medium · 6.4 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS ↗
   2025-11-04 CVE-2025-11162 Improper Neutralization of Input During Web Page Generation Affects <= 2.19.14 Patched in 2.19.15
10. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-03-25 CVE-2025-1784 Improper Neutralization of Input During Web Page Generation Affects <= 2.19.0 Patched in 2.19.1
11. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget ↗
    2024-12-02 CVE-2024-10484 Improper Neutralization of Input During Web Page Generation Affects <= 2.16.2 Patched in 2.16.3
12. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-site Scripting ↗
    2024-08-07 CVE-2024-7590 Improper Neutralization of Input During Web Page Generation Affects <= 2.15.0 Patched in 2.15.1
13. Patched Medium · 4.3 Spectra <= 2.13.7 - Missing Authorization via generate_ai_content ↗
    2024-07-05 CVE-2024-37517 Missing Authorization Affects <= 2.13.7 Patched in 2.13.8
14. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2024-05-23 CVE-2024-4366 Improper Neutralization of Input During Web Page Generation Affects <= 2.13.0 Patched in 2.13.1
15. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block ↗
    2024-05-22 CVE-2024-1815 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.8 Patched in 2.12.9
16. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block ↗
    2024-05-22 CVE-2024-1814 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.8 Patched in 2.12.9
17. Patched Medium · 4.3 Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal ↗
    2024-04-26 CVE-2024-3107 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.12.6 Patched in 2.12.7
18. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS ↗
    2024-04-03 CVE-2023-6486 Improper Neutralization of Input During Web Page Generation Affects <= 2.10.3 Patched in 2.10.4
19. Patched Medium · 6.4 Spectra <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-05 CVE-2023-49833 Improper Neutralization of Input During Web Page Generation Affects <= 2.7.9 Patched in 2.7.10
20. Patched High · 8.5 Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms ↗
    2023-07-14 CVE-2023-36679 Server-Side Request Forgery Affects <= 2.6.6 Patched in 2.6.7
21. Patched Medium · 4.3 Spectra <= 2.6.6 - Missing Authorization ↗
    2023-07-14 CVE-2023-36676 Missing Authorization Affects <= 2.6.6 Patched in 2.6.7
22. Patched Medium · 6.4 Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in template_importer ↗
    2023-07-14 Server-Side Request Forgery Affects <= 2.6.6 Patched in 2.6.7
23. Patched Medium · 6.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to Plugin Activation ↗
    2023-01-25 CVE-2023-23834 Cross-Site Request Forgery Affects <= 2.3.1 Patched in 2.3.2
24. Patched Medium · 6.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks ↗
    2023-01-25 Missing Authorization Affects <= 2.3.1 Patched in 2.3.2
25. Patched Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 1.14.11 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-01-24 CVE-2020-36656 Improper Neutralization of Input During Web Page Generation Affects <= 1.14.11 Patched in 1.15.0
26. Patched Medium · 5.4 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import ↗
    2023-01-23 CVE-2023-23825 Cross-Site Request Forgery Affects <= 2.3.1 Patched in 2.3.2
27. Patched Medium · 5.4 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization to Captcha Setting Update ↗
    2023-01-23 CVE-2023-23729 Missing Authorization Affects <= 2.3.1 Patched in 2.3.2
28. Patched Medium · 6.5 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - HTML Injection in Emails ↗
    2023-01-23 CVE-2023-23735 Improper Input Validation Affects <= 2.3.1 Patched in 2.3.2
29. Patched Medium · 5.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Email Spoofing ↗
    2023-01-23 CVE-2023-23738 Insufficient Verification of Data Authenticity Affects <= 2.3.1 Patched in 2.3.2
30. Patched Medium · 5.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Captcha Bypass ↗
    2023-01-23 CVE-2023-23730 Guessable CAPTCHA Affects <= 2.3.1 Patched in 2.3.2
31. Patched Medium · 6.1 Spectra – WordPress Gutenberg Blocks <= 1.25.5 - Reflected Cross-Site Scripting ↗
    2022-05-31 Improper Neutralization of Input During Web Page Generation Affects <= 1.25.5 Patched in 1.25.6
32. Patched Medium · 5.5 Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization ↗
    2020-03-30 CVE-2020-36702 Missing Authorization Affects <= 1.14.7 Patched in 1.14.8

Translated into 31 languages, 13 at 90% or more

Plus 7 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-10-11 900K+ → 1M+ up after 65 days in tier
2. 2024-08-07 800K+ → 900K+ up after 57 days in tier
3. 2024-06-11 700K+ → 800K+ up after 60 days in tier
4. 2024-04-12 600K+ → 700K+ up after 161 days in tier
5. 2023-11-03 500K+ → 600K+ up after 195 days in tier
6. 2023-04-22 400K+ → 500K+ up after 200 days in tier
7. 2022-10-04 300K+ → 400K+ up after 582 days in tier
8. 2021-03-01 200K+ → 300K+ up after 445 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Spectra Legacy – Gutenberg Blocks into a readme, a review or a deck. It updates itself.

Spectra Legacy – Gutenberg Blocks: 1M+ active installs, 4.7★ (1,872 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/ultimate-addons-for-gutenberg