Getwid Gutenberg Blocks
Monthly
Stored cross-site scripting in the Getwid - Gutenberg Blocks plugin for WordPress (all versions up to and including 3.0.1) allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts through the 'data-image-points' parameter, which are then stored and executed whenever another user - an editor, administrator, or site visitor - accesses the affected page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms the attacker needs a low-privileged authenticated account but requires no victim interaction to trigger the payload beyond viewing the injected page, and the changed scope indicates the script executes in the context of the broader site rather than the attacker's own content. No public exploit code has been identified at the time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so practical exposure is concentrated on sites that provision contributor accounts to untrusted users or allow open registration; a site with only a single administrator and no contributor roles faces minimal real-world risk.
Stored cross-site scripting in the Getwid - Gutenberg Blocks WordPress plugin (all versions up to and including 2.1.3) allows authenticated attackers holding Contributor-level privileges or higher to inject arbitrary JavaScript through the Google Maps block's 'customStyle' attribute, because the frontend mapStyles() function passes that user-controlled value to eval(). The injected script is persisted in the post/block content and executes automatically in the browser of any visitor who renders the affected page, enabling session theft, content injection, or redirection under the site's origin (CVSS 6.4, Medium, with a Scope-Changed vector reflecting code execution outside the plugin's intended boundary). Exploitation requires a posting-capable account and no special non-default configuration; no public exploit code has been identified at time of analysis, and the issue is documented in a public Wordfence advisory.
Stored cross-site scripting in the Getwid - Gutenberg Blocks plugin for WordPress (all versions up to and including 3.0.1) allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts through the 'data-image-points' parameter, which are then stored and executed whenever another user - an editor, administrator, or site visitor - accesses the affected page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms the attacker needs a low-privileged authenticated account but requires no victim interaction to trigger the payload beyond viewing the injected page, and the changed scope indicates the script executes in the context of the broader site rather than the attacker's own content. No public exploit code has been identified at the time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so practical exposure is concentrated on sites that provision contributor accounts to untrusted users or allow open registration; a site with only a single administrator and no contributor roles faces minimal real-world risk.
Stored cross-site scripting in the Getwid - Gutenberg Blocks WordPress plugin (all versions up to and including 2.1.3) allows authenticated attackers holding Contributor-level privileges or higher to inject arbitrary JavaScript through the Google Maps block's 'customStyle' attribute, because the frontend mapStyles() function passes that user-controlled value to eval(). The injected script is persisted in the post/block content and executes automatically in the browser of any visitor who renders the affected page, enabling session theft, content injection, or redirection under the site's origin (CVSS 6.4, Medium, with a Scope-Changed vector reflecting code execution outside the plugin's intended boundary). Exploitation requires a posting-capable account and no special non-default configuration; no public exploit code has been identified at time of analysis, and the issue is documented in a public Wordfence advisory.