Getwid Gutenberg Blocks CVE-2026-91862

Exploitation requires an authenticated account with contributor-level privileges or higher on a WordPress site running the Getwid - Gutenberg Blocks plugin version 3.0.1 or earlier, and the attacker must be able to author/edit block content that uses the affected 'data-image-points' parameter. The stored payload only fires when another user (e.g., an administrator, editor, or visitor) subsequently accesses the injected page, so impact depends on a victim viewing the content. Key limiting factors: the required contributor-level authentication (per PR:L) restricts this to sites that provision low-trust author accounts; sites with only a single administrator and no open registration or contributor roles face little practical exposure.

This is a moderate-severity Stored XSS (CVSS 6.4, CWE-79) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The AV:N/AC:L/UI:N combination suggests easy remote exploitation, but PR:L is the decisive limiter: the attacker must already hold a contributor-level (or higher) authenticated account on the target WordPress site, which materially narrows the realistic attacker population to sites that provision such accounts. The scope change (S:C) and low confidentiality/integrity impact reflect typical stored-XSS behavior - payload executes in the browser of whoever views the injected page, crossing the security boundary from the authoring context to the victim's session. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Net assessment: a genuine but not emergency-priority issue - it ranks below unauthenticated or admin-impact flaws. Priority rises on multi-author sites (membership, multi-contributor blogs, agencies) where low-trust accounts exist; it is near-negligible on single-admin sites where no contributor accounts are issued. Signals are internally consistent - no conflict between CVSS and description.

An attacker who has obtained or been granted a contributor-level account on a WordPress site running Getwid ≤3.0.1 crafts a block containing a malicious payload in the 'data-image-points' parameter, which is stored without adequate sanitization. When an administrator, editor, or site visitor later views the page, the script executes in their browser context, enabling session hijacking, credential theft, or privilege escalation toward site takeover. No public exploit code is identified at time of analysis, and exploitation requires an existing low-privilege authenticated account.