CVE-2026-91862: Getwid Gutenberg Blocks XSS Vulnerability

CVE-2026-91862 Overview

CVE-2026-91862 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Getwid – Gutenberg Blocks plugin for WordPress. The flaw affects all versions up to and including 3.0.1. Attackers can inject arbitrary JavaScript through the data-image-points parameter due to insufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can exploit this weakness. Injected scripts execute in the browser of any visitor accessing the affected page.

Critical Impact
Authenticated contributors can store malicious JavaScript that executes against site administrators and visitors, enabling session theft, account takeover, and persistent site compromise.

Affected Products

Getwid – Gutenberg Blocks plugin for WordPress
All versions up to and including 3.0.1
WordPress sites allowing contributor-level accounts or higher

Discovery Timeline

2026-10-10 - CVE-2026-91862 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-91862

Vulnerability Analysis

The Getwid plugin exposes a Gutenberg block that accepts user-supplied values through the data-image-points attribute. The plugin writes these values back to rendered page markup without proper sanitization or escaping. An attacker with at least contributor privileges can craft block content that embeds JavaScript inside this attribute. When an administrator or site visitor loads the resulting page, the browser parses and executes the injected payload in the context of the WordPress site. This exposure allows cookie theft, forced administrative actions, defacement, and pivoting into site takeover through authenticated admin requests.

Root Cause

The root cause is missing input validation on the server-side handler and absent output escaping on the render path for the data-image-points attribute. WordPress provides functions such as esc_attr() and wp_kses() for exactly this purpose, but the plugin did not apply them to this parameter before echoing content to the DOM.

Attack Vector

Exploitation requires an authenticated session with contributor-level permissions. The attacker edits or creates a post containing the affected Getwid block and supplies a malicious value for data-image-points. The payload persists in the WordPress database. Any subsequent visitor that renders the post triggers script execution. No user interaction beyond normal page browsing is required.

No verified proof-of-concept code is published alongside this advisory. See the Wordfence Vulnerability Analysis for technical details.

Detection Methods for CVE-2026-91862

Indicators of Compromise

Post or page content containing data-image-points attributes with embedded <script> tags, javascript: URIs, or event handlers such as onerror= or onload=.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading a Getwid-rendered page.
Creation of new administrator accounts or modification of user roles following contributor activity.

Detection Strategies

Query the wp_posts table for post content matching patterns like data-image-points="[^"]*< or data-image-points="[^"]*on\w+=.
Review WordPress audit logs for post edits performed by contributor accounts targeting Getwid blocks.
Deploy a Web Application Firewall (WAF) rule to flag block content containing script-like constructs within attribute values.

Monitoring Recommendations

Monitor administrator session activity for unusual REST API calls originating from browsers that recently rendered posts authored by contributors.
Alert on changes to installed plugins, themes, or user roles following page loads by privileged users.
Track plugin version inventory to confirm all WordPress sites run Getwid above 3.0.1.

How to Mitigate CVE-2026-91862

Immediate Actions Required

Update the Getwid – Gutenberg Blocks plugin to the version that supersedes 3.0.1 as published in WordPress Changeset 3698562.
Audit all existing posts and pages created or modified by contributor-level accounts for suspicious data-image-points content.
Rotate credentials and session tokens for any administrator who accessed affected pages before patching.

Patch Information

The vendor committed a fix in WordPress Changeset 3698562, which addresses the missing sanitization and escaping on the data-image-points attribute. Site owners should upgrade through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Restrict contributor-level and higher accounts to trusted users only until the patch is applied.
Temporarily disable the Getwid – Gutenberg Blocks plugin on sites where immediate patching is not feasible.
Deploy a WAF rule that blocks POST requests to /wp-json/wp/v2/posts containing script payloads inside data-image-points.

bash

# Update Getwid via WP-CLI to the patched release
wp plugin update getwid --version=<patched-version>

# Verify the installed version
wp plugin get getwid --field=version