A Stored Cross-Site Scripting vulnerability in the Getwid – Gutenberg Blocks plugin for WordPress allows authenticated contributors to execute malicious scripts on affected pages.

This vulnerability occurs due to the use of the eval() function on user-controlled input within the Google Maps block customStyle attribute. Authenticated users with Contributor-level access or higher can inject malicious JavaScript that executes when a victim views the affected page.

The ability to inject arbitrary scripts into a website creates a significant risk of session hijacking, unauthorized actions performed on behalf of site administrators, and the potential for defacement. Given the CVSS score of 6.4, this vulnerability represents a moderate risk that could lead to the compromise of user accounts and sensitive data. Organizations relying on this plugin for frontend content management should treat this as a priority to prevent potential cross-site scripting attacks.

Immediate Action: Update the Getwid – Gutenberg Blocks plugin to version 2.2.0 or later immediately to resolve the vulnerable eval() implementation.

Proactive Monitoring: Review WordPress audit logs for unusual activity from Contributor-level accounts and monitor for suspicious script tags or unexpected modifications to Google Maps block configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious XSS payloads, particularly those attempting to exploit eval() or script injection within block attributes.

Public Exploit Available: Unknown

The presence of an XSS vulnerability in a widely used block plugin poses a credible risk to the integrity of your WordPress installation. Administrators must upgrade to version 2.2.0 without delay to eliminate the vulnerable code path. If immediate patching is not feasible, restrict access to the Gutenberg editor for lower-privileged users until the update can be applied.