Spectra Legacy – Gutenberg Blocks

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 23% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

Reviewers keep praising quick, friendly support, especially from Ravi and the team, though one long-time user flagged missing blocks and no downgrade path after the V3 upgrade, and another hit a tabs-block bug on WordPress 7.

1. ★★★★★ arabellawatches

   2mo ago

   I am absolutely thrilled with Spectra! It is incredibly easy to use and has allowed me to build my entire WordPress website using Astra + Spectra from scratch, without having any prior knowledge of programming or web construction. But what completely blew me away was their support. I am deeply grateful for the level of involvement, efficiency, and kindness shown by the support service, specifically Ravi & the Customer Care team at Brainstorm Force. They went above and beyond to help me. Highly recommended tool for anyone looking for a clean, efficient, and professional web building experience!

   Read on wp.org ↗
2. ★★★★★ sokostas

   2mo ago

   I switched a lot of my elementor websites to spectra pro and astra. The performance is better.

   Read on wp.org ↗
3. ★★★★★ Wilf James

   2mo ago

   First time using this and had a small problem with getting this to work in my install. I opened a support ticket and received a lighting fast comprehensive reply asking for a little more detail. However my answer was in that first reply and I solved the problem. It was down to the learning curve. The product is first class and the support is first class plus.

   Read on wp.org ↗
4. ★★★★★ vince34

   2mo ago

   Thème cher et peu intéressant

   Read on wp.org ↗
5. ★★★★★ alexhuber98

   2mo ago

   After manually downgrading to V2 and not being able to upgrade to V3 again, Spectra support quickly helped me in restoring my website. All went smoothly, thank you!

   Read on wp.org ↗
6. ★★★★★ effx1863

   2mo ago

   I was evaluating new tools for our business and found the Spectra and Astra excellent!! We were testing three othe rproducts. I was able to use the free version to assign web development task to three techs who where able get up speed and create beautiful websites in record time. We had one issue with licensing and the response was unbelievably fast and professional!! The key to any great company is it’s communication and support and both are excellent! Extremely Happy and impressed!

   Read on wp.org ↗
7. ★★★★★ Paolo Cigala

   2mo ago

   Not only is it an excellent system, but it also gives you the certainty of being listened to and receiving support in case of need. Thx Ravi and all client support team

   Read on wp.org ↗
8. ★★★★★ jimk1416

   2mo ago

   Another issue and another quick knowledgeable answer from the support team. Highly recommend.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.20.0 Renamed to “Spectra Legacy”; all blocks, settings, and content remain fully intact. Fix: This update addressed a security bug. Props to Muni Nitish Kumar Yaddala and WPScan for the responsible disclosure. Fix: Info Box — 2.20.0
2. — Version 2.19.29 Fix: This update addressed a security bug. Props to Wordfence for reporting it responsibly to our team. Please make sure you are using the latest version on your website. Fix: WPML compatibility — resolved PHP error caus 2.19.29
3. — Version 2.19.28 Fix: FAQ — Existing FAQ blocks created before the apiVersion 3 update now validate correctly in the editor. Fix: Info Box CTA button colors were not applying on the frontend when “Inherit from Theme” is disabled. 2.19.28
4. — Version 2.19.27 New: Added full compatibility with WordPress 7.0 — all blocks migrated to apiVersion 3 for iframe editor support. Fix: Resolved fatal errors on WordPress.com Atomic hosting. 2.19.27
5. — Version 2.19.26 This update addressed a security bug. Props to Wordfence for reporting it responsibly to our team. Please make sure you are using the latest version on your website. Fix: Resolved a PHP warning triggered when inserting i 2.19.26
6. — Version 2.19.25 Fix: RTL support for Timeline, Testimonial, and Info Box blocks — now render correctly in right-to-left languages. 2.19.25

30 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.4 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block ↗
   2026-07-20 CVE-2026-12900 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.19.28 Patched in 2.19.29
2. Medium · 4.3 Spectra Legacy – Gutenberg Blocks < 2.20.0 - Authenticated (Contributor+) CSS Injection ↗
   2026-07-20 CVE-2026-10827 Improper Input Validation Affects < 2.20.0 Patched in 2.20.0
3. High · 8.8 Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes ↗
   2026-05-29 CVE-2026-7465 Improper Privilege Management Affects <= 2.19.25 Patched in 2.19.26
4. Medium · 4.3 Spectra <= 2.19.22 - Missing Authorization ↗
   2026-03-27 CVE-2026-42648 Missing Authorization Affects <= 2.19.22 Patched in 2.19.23
5. Medium · 5.3 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data ↗
   2026-02-02 CVE-2026-0950 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.19.17 Patched in 2.19.18
6. Medium · 5.3 Spectra <= 2.19.17 - Missing Authorization ↗
   2026-01-17 CVE-2026-24982 Missing Authorization Affects <= 2.19.17 Patched in 2.19.18
7. Medium · 6.4 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS ↗
   2025-11-04 CVE-2025-11162 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.19.14 Patched in 2.19.15
8. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-03-25 CVE-2025-1784 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.19.0 Patched in 2.19.1
9. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget ↗
   2024-12-02 CVE-2024-10484 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.16.2 Patched in 2.16.3
10. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-site Scripting ↗
    2024-08-07 CVE-2024-7590 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.15.0 Patched in 2.15.1
11. Medium · 4.3 Spectra <= 2.13.7 - Missing Authorization via generate_ai_content ↗
    2024-07-05 CVE-2024-37517 Missing Authorization Affects <= 2.13.7 Patched in 2.13.8
12. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2024-05-23 CVE-2024-4366 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.13.0 Patched in 2.13.1
13. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block ↗
    2024-05-22 CVE-2024-1815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.12.8 Patched in 2.12.9
14. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block ↗
    2024-05-22 CVE-2024-1814 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.12.8 Patched in 2.12.9
15. Medium · 4.3 Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal ↗
    2024-04-26 CVE-2024-3107 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.12.6 Patched in 2.12.7
16. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS ↗
    2024-04-03 CVE-2023-6486 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.3 Patched in 2.10.4
17. Medium · 6.4 Spectra <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-05 CVE-2023-49833 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.7.9 Patched in 2.7.10
18. High · 8.5 Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms ↗
    2023-07-14 CVE-2023-36679 Server-Side Request Forgery (SSRF) Affects <= 2.6.6 Patched in 2.6.7
19. Medium · 4.3 Spectra <= 2.6.6 - Missing Authorization ↗
    2023-07-14 CVE-2023-36676 Missing Authorization Affects <= 2.6.6 Patched in 2.6.7
20. Medium · 6.4 Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in template_importer ↗
    2023-07-14 Server-Side Request Forgery (SSRF) Affects <= 2.6.6 Patched in 2.6.7
21. Medium · 6.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to Plugin Activation ↗
    2023-01-25 CVE-2023-23834 Cross-Site Request Forgery (CSRF) Affects <= 2.3.1 Patched in 2.3.2
22. Medium · 6.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks ↗
    2023-01-25 Missing Authorization Affects <= 2.3.1 Patched in 2.3.2
23. Medium · 6.4 Spectra – WordPress Gutenberg Blocks <= 1.14.11 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-01-24 CVE-2020-36656 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.14.11 Patched in 1.15.0
24. Medium · 5.4 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import ↗
    2023-01-23 CVE-2023-23825 Cross-Site Request Forgery (CSRF) Affects <= 2.3.1 Patched in 2.3.2
25. Medium · 5.4 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization to Captcha Setting Update ↗
    2023-01-23 CVE-2023-23729 Missing Authorization Affects <= 2.3.1 Patched in 2.3.2
26. Medium · 6.5 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - HTML Injection in Emails ↗
    2023-01-23 CVE-2023-23735 Improper Input Validation Affects <= 2.3.1 Patched in 2.3.2
27. Medium · 5.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Email Spoofing ↗
    2023-01-23 CVE-2023-23738 Insufficient Verification of Data Authenticity Affects <= 2.3.1 Patched in 2.3.2
28. Medium · 5.3 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Captcha Bypass ↗
    2023-01-23 CVE-2023-23730 Guessable CAPTCHA Affects <= 2.3.1 Patched in 2.3.2
29. Medium · 6.1 Spectra – WordPress Gutenberg Blocks <= 1.25.5 - Reflected Cross-Site Scripting ↗
    2022-05-31 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.25.5 Patched in 1.25.6
30. Medium · 5.5 Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization ↗
    2020-03-30 CVE-2020-36702 Missing Authorization Affects <= 1.14.7 Patched in 1.14.8

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 29 languages, 11 at 90% or more

Plus 5 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-10-11 900K+ → 1M+ up after 65 days in tier
2. 2024-08-07 800K+ → 900K+ up after 57 days in tier
3. 2024-06-11 700K+ → 800K+ up after 60 days in tier
4. 2024-04-12 600K+ → 700K+ up after 161 days in tier
5. 2023-11-03 500K+ → 600K+ up after 195 days in tier
6. 2023-04-22 400K+ → 500K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Genesis Blocks 40K+ installs · 3.8★ · 5 shared tags B
• Snow Monkey Forms 30K+ installs · 4.3★ · 5 shared tags A
• Snow Monkey Blocks 30K+ installs · 4.1★ · 5 shared tags B
• Qubely – Advanced Gutenberg Blocks 7K+ installs · 4.0★ · 5 shared tags C
• Gutenberg Blocks Library & Toolkit – Editor Plus 6K+ installs · 4.6★ · 5 shared tags D
• Gutenify – Visual Site Builder Blocks & Site Templates 5K+ installs · 4.2★ · 5 shared tags A

Embed this report card

Drop a live Pulse card for Spectra Legacy – Gutenberg Blocks into a readme, a review or a deck. It updates itself.

Spectra Legacy – Gutenberg Blocks: 1M+ active installs, 4.7★ (1,870 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/ultimate-addons-for-gutenberg