CVE-2026-91862

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks versions prior to 3.0.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the data-image-points parameter. These scripts execute whenever a user visits the affected page.

Recommendations Update Getwid – Gutenberg Blocks to version 3.0.2 or later. As a temporary mitigation, restrict access to the data-image-points parameter for users with contributor-level permissions.