Getwid – Gutenberg Blocks
Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the `eval()` function on user-controlled block content within the frontend JavaScript `mapStyles()` function. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.