CVE-2026-5924 Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval on user-controlled block content in the frontend JavaScript mapStyles...

CVE-2026-5924 Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval on user-controlled block content in the frontend JavaScript mapStyles...

CVE-2026-5924

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.3 . The flaw exists within the Google Maps block due to the customStyle attribute, where the mapStyles() function in the frontend JavaScript uses eval() on...

EUVD-2026-85111

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval on user-controlled block content in the frontend JavaScript mapStyles...

CVE-2026-5924: Improper Neutralization of Input During Web Page Generation

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval on user-controlled block content in the frontend JavaScript mapStyles...

PT-2026-97202

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks versions prior to 2.1.4 Description Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the eval function on user-controlled block content withi...