Executive brief
The Getwid plugin for WordPress, which provides custom content blocks for the WordPress editor, contains a stored cross-site scripting vulnerability in its Google Maps block. An authenticated user with Contributor-level permissions or higher can inject malicious JavaScript that will execute for all visitors viewing the affected page. This could allow attackers to steal session cookies, redirect users to phishing sites, or deface page content.
Technical details
The vulnerability exists in the frontend JavaScript mapStyles() function, which uses eval() to process user-controlled 'customStyle' attribute data from the Google Maps block without proper sanitization. An authenticated attacker with Contributor role or above can inject arbitrary JavaScript into block content that persists in the page. The injected script executes in the context of all site visitors, enabling privilege escalation and content manipulation.
Affected products
- Getwid Gutenberg Blocks up to 2.1.3
Timeline
- 2026-09-23: disclosed