Getwid Gutenberg Blocks CVE-2026-5924

Requires an authenticated WordPress account with Contributor-level privileges or above on a site running Getwid - Gutenberg Blocks ≤2.1.3. The attacker must be able to add a Google Maps block and control its 'customStyle' attribute, which the frontend mapStyles() function evaluates via eval(). Exploitation is limited by this posting-account prerequisite (no unauthenticated path) but needs no special non-default configuration beyond the plugin being active; execution then triggers automatically whenever any user renders the injected page (no attacker-side user interaction, though a victim must view the page).

This is a stored XSS (CWE-79) rated CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The signals are internally consistent: network vector, low complexity, but PR:L confirms exploitation requires an authenticated account with Contributor-level access or above - not an unauthenticated flaw. The scope change (S:C) and split C:L/I:L reflect script execution crossing from the injected page into the browser context of any user (potentially higher-privileged admins) who views it, which is the standard Wordfence scoring pattern for stored XSS. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' Real-world priority is moderate and gated primarily by the Contributor-access prerequisite: sites that allow untrusted user registration at Contributor+ (multi-author blogs, membership sites) face meaningful risk, whereas single-author or tightly-controlled sites face little. The eval()-on-user-content root cause makes reliable exploitation trivial once an attacker has a posting account, but the auth gate keeps this well below a wormable/critical concern.

An attacker registers or obtains a Contributor-level account on a WordPress site running Getwid ≤2.1.3, then inserts a Google Maps block and places a malicious payload in its 'customStyle' attribute, which the frontend mapStyles() function passes to eval(). When any visitor or administrator later views that page, the script executes in their browser, enabling session/cookie theft or actions in an admin's context. No public POC is referenced, but the vulnerable code path is documented in the plugin source (frontend.js#L4 and google-map.php#L139).