CVE-2026-5924

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks versions prior to 2.1.4

Description Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the eval() function on user-controlled block content within the frontend JavaScript mapStyles() function. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update Getwid – Gutenberg Blocks to version 2.1.4 or later. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit the Google Maps block or modify the customStyle attribute.