CVE-2026-5924: Getwid WordPress Plugin XSS Vulnerability

CVE-2026-5924 Overview

CVE-2026-5924 is a Stored Cross-Site Scripting (XSS) vulnerability in the Getwid – Gutenberg Blocks plugin for WordPress. The flaw affects all versions up to and including 2.1.3. The root cause is the use of eval() on user-controlled block content inside the frontend JavaScript mapStyles() function tied to the Google Maps block's customStyle attribute. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when the affected page is rendered. The issue is tracked under CWE-79.

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that execute for every visitor, enabling session theft, forced administrative actions, and site defacement.

Affected Products

Getwid – Gutenberg Blocks plugin for WordPress, all versions ≤ 2.1.3
WordPress sites running the Getwid Google Maps block with the customStyle attribute
Any WordPress site that grants Contributor or higher roles to untrusted users while the plugin is active

Discovery Timeline

2026-09-23 - CVE-2026-5924 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-5924

Vulnerability Analysis

The Getwid plugin renders a Google Maps block on the frontend using a script located at assets/blocks/map/frontend.js. That script defines a mapStyles() helper that passes the block's customStyle attribute directly into JavaScript's eval() function. Because customStyle originates from block content saved by any authenticated author, a Contributor can embed a JavaScript payload disguised as map style data. When a visitor loads the page, the browser evaluates the attacker-controlled string in the site's origin. This yields persistent, reflected-into-DOM script execution against every viewer, including administrators. The impact aligns with typical Stored XSS: cookie theft, credential harvesting via injected forms, forced posting through the WordPress REST API, and delivery of downstream browser exploits.

Root Cause

The defect is straightforward unsafe dynamic evaluation. The frontend calls eval() on the customStyle attribute without validation, JSON parsing, schema enforcement, or output sanitization. The corresponding server-side handler in includes/blocks/google-map.php emits the raw attribute value into the page output. Combined, these choices break WordPress's expectation that block attributes are treated as data, not code.

Attack Vector

An attacker authenticates as a Contributor (or higher), creates or edits a post containing a Getwid Google Maps block, and sets the block's customStyle attribute to a string that terminates the expected style object and appends arbitrary JavaScript. Once a reviewer, editor, or public visitor opens the page, the mapStyles() routine invokes eval() on the payload and executes it in the browser context of the WordPress site. No user interaction beyond page load is required. See the Wordfence Vulnerability Report and the Getwid Frontend JS Source for the vulnerable code path.

Detection Methods for CVE-2026-5924

Indicators of Compromise

Post or page content containing Getwid Google Map blocks whose customStyle attribute includes JavaScript keywords such as function, alert, fetch, document.cookie, or <script.
Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from pages that embed the Google Maps block.
New administrator accounts or modified user roles created shortly after a Contributor edited a page containing a map block.
Browser console errors referencing mapStyles or eval on pages that render the Getwid map block.

Detection Strategies

Query the wp_posts table for post_content matching wp:getwid/map blocks and inspect the customStyle JSON attribute for non-style tokens.
Deploy a Web Application Firewall (WAF) rule that inspects saved block content and blocks payloads containing script constructs inside customStyle.
Enable Content Security Policy (CSP) reporting to surface unsafe-eval violations originating from the plugin's frontend script.

Monitoring Recommendations

Audit Contributor, Author, and Editor account activity, focusing on block edits touching the Getwid Google Maps block.
Monitor WordPress post_updated and save_post hooks with logging for changes to block attributes.
Track plugin version inventory across WordPress fleets and alert on installations pinned at or below Getwid 2.1.3.

How to Mitigate CVE-2026-5924

Immediate Actions Required

Update the Getwid – Gutenberg Blocks plugin to a version newer than 2.1.3 once the vendor publishes the patched release.
Temporarily deactivate the Getwid plugin on sites that accept Contributor-level submissions from untrusted users.
Review recent posts and drafts for Getwid Google Map blocks and remove any customStyle values that are not valid Google Maps JSON style arrays.
Rotate administrator session cookies and reset credentials if evidence of exploitation is found.

Patch Information

Refer to the Getwid Changeset Review for the vendor's remediation commit and the Wordfence Vulnerability Report for confirmed fixed versions. Administrators should upgrade through the WordPress plugin manager or WP-CLI and verify the installed version is above 2.1.3.

Workarounds

Restrict the Contributor, Author, and Editor roles to trusted users only until the patch is deployed.
Remove or disable the Getwid Google Maps block via a custom allowed_block_types_all filter to prevent authors from inserting it.
Enforce a Content Security Policy that omits unsafe-eval, which breaks the vulnerable mapStyles() execution path.
Deploy a WordPress hardening plugin or WAF signature that strips script tokens from block attributes on save.

bash

# Configuration example: block Getwid map block via must-use plugin filter
add_filter( 'allowed_block_types_all', function( $allowed, $editor_context ) {
    if ( ! is_array( $allowed ) ) {
        return $allowed;
    }
    return array_values( array_diff( $allowed, array( 'getwid/map' ) ) );
}, 10, 2 );