We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Getwid – Gutenberg Blocks Plugin Vulnerability (CVE-2026-5924)

Nick Paliughi
On this page

Security Alert Summary

The Getwid – Gutenberg Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the Google Maps block. The issue arises from the plugin executing user-controlled content via eval() in the frontend JavaScript mapStyles() function, allowing authenticated users with Contributor-level access and above to inject scripts that execute when a page is viewed.

CVE Details

  • CVE ID: CVE-2026-5924
  • Affected component: Getwid – Gutenberg Blocks plugin, Google Maps block (customStyle attribute)
  • Affected versions: All versions up to and including 2.1.3
  • Published: September 23, 2026 at 7:16:45 AM
  • Last modified: September 23, 2026 at 3:17:14 PM
  • CVSS v3.1: Base Score 6.4, Medium — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: Requires authentication with low privileges (PR:L). The vendor disclosure notes exploitation by authenticated attackers with Contributor-level access and above. User interaction is NONE per CVSS.
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • Weakness: CWE-79 (Cross-site Scripting)

Technical Details

This vulnerability is a stored XSS in the Google Maps block caused by use of eval() on attacker-controlled block content. The plugin exposes a customStyle attribute for the Maps block whose content is processed by the frontend JavaScript mapStyles() function. Because eval() executes the provided string as code, an authenticated user with sufficient privileges can inject arbitrary JavaScript into that attribute, which is then stored and rendered in pages.

The impact is limited to the contexts where the injected block is displayed: any visitor who opens a page containing the injected Maps block will have the injected script execute in their browser. The disclosure identifies the specific function (mapStyles()) and the use of eval() as the root cause. No other endpoints, checks, or additional vectors are described in the provided data.

How This Could Impact Your Website

Consider a site with multiple users: a site owner, internal staff editors, and an external contractor who can contribute content. If a contributor or another authenticated user with the required privileges modifies or creates a Google Maps block and inserts a malicious customStyle payload, the injected script could run when administrators, editors, or site visitors view that page.

  • Internal user email addresses or other data displayed on affected pages could be exposed to injected scripts.
  • Attackers could use harvested information to craft targeted phishing or social engineering campaigns against staff or customers.
  • The site owner and staff may experience denial of trust for pages that silently execute injected scripts, even though the site files or server may not be directly compromised.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles; limit contributor or higher privileges to trusted users only.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins to reduce your attack surface.
  • Monitor site activity and page content for unusual behavior or unexpected script injections.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Forminator Forms Plugin Vulnerability (CVE-2026-87071)
Next Post
Forminator Forms Plugin Vulnerability (CVE-2026-87070)