CVE-2026-5924

29th percentile - higher than 29% of all known CVEs

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

An attacker can inject malicious scripts that execute in visitors' browsers, potentially leading to session theft, redirects, or other attacks. This poses a serious threat to site users.

Update the Getwid – Gutenberg Blocks plugin to a version later than 2.1.3 that fixes the vulnerability. Consider restricting user privileges and implementing a Content Security Policy (CSP).