Description

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-23T07:16:45.720Z",
  "pubdate": "2026-09-23T07:16:45.720Z",
  "executiveSummary": "The Getwid – Gutenberg Blocks plugin for WordPress, in versions up to and including 2.1.3, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from the improper handling of user-supplied data within the Google Maps block's 'customStyle' attribute.\nThe vulnerability type is categorized as Stored XSS, allowing an authenticated attacker with Contributor-level access or higher to inject malicious JavaScript into the plugin's frontend components. Because the application processes this input using the eval() function, the injected scripts are executed within the context of a victim's browser whenever they access the compromised page.\nThe impact of this vulnerability is significant, as it enables attackers to perform unauthorized actions on behalf of users, exfiltrate sensitive session cookies, redirect users to malicious domains, or deface the website. The exploitation requirement involves a successful authentication to the WordPress dashboard at the Contributor level, after which the attacker can store the malicious payload within the block attributes.\nGiven that WordPress contributors are often permitted to edit posts, this vulnerability poses a substantial risk to the integrity and confidentiality of the platform, necessitating immediate attention and remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure use of the JavaScript eval() function within the frontend mapStyles() function. The Getwid plugin's Google Maps block allows users to define custom styles via the 'customStyle' attribute. Instead of sanitizing this input or utilizing secure parsing mechanisms like JSON.parse(), the plugin passes the user-controlled content directly to eval().\nBecause eval() executes any string passed to it as code, an attacker can supply a specially crafted string containing malicious JavaScript instead of a valid style object. When a page containing this modified Google Maps block is rendered, the frontend JavaScript function mapStyles() is invoked, triggering the execution of the injected script in the context of the browser session of any user viewing the page.\nThe attack flow proceeds as follows: 1. An authenticated user with Contributor-level privileges navigates to the WordPress block editor. 2. The user adds a Google Maps block to a post. 3. The user modifies the 'customStyle' attribute of the block to include a malicious JavaScript payload designed to trigger an alert, steal session cookies via document.cookie, or perform unauthorized DOM manipulation. 4. The malicious content is saved to the WordPress database as part of the post content. 5. When a victim, such as an administrator or another site user, visits the page containing the malicious block, the plugin's frontend code retrieves the tainted 'customStyle' attribute and passes it to mapStyles(). 6. The internal call to eval() executes the stored script within the victim's session.\nThis vulnerability is present in all versions of the Getwid – Gutenberg Blocks plugin up to and including 2.1.3. The exposure is limited to the client-side execution environment, but the persistence of the payload in the database ensures that every visitor to the target page is impacted. Post-exploitation, an attacker can leverage the victim's privileges to perform administrative actions, potentially escalating their own privileges or conducting further site-wide compromises depending on the victim's session capabilities."
}