WordPress security by component

Getwid – Gutenberg Blocks

Plugin description

Getwid – Gutenberg Blocks adds Gutenberg blocks and block patterns for creating diverse WordPress page and content layouts.

Getwid – Gutenberg Blocks (getwid) is a WordPress plugin with 11 published CVE records in this archive. The latest tracked vulnerability was published Sep 23, 2026; the highest published CVSS base score is 8.5.

Plugin slug: getwid

Latest vulnerability

CVE-2026-5924: Getwid evaluates Google Maps customStyle as JavaScript

A Contributor or higher can store attacker-controlled content in the Google Maps block's customStyle attribute. The frontend mapStyles() function evaluates that value with eval(), causing stored script to run in the site's origin when a user views the affected page. The narrative covers releases through 2.1.3; the structured version field names only 2.1.3. Affected versions: <= 2.1.3 according to the narrative (the structured field names 2.1.3). Confirmed fixed release: 2.2.0.

PublishedSep 23, 2026

Known safe version2.2.0

Published vulnerabilities for getwid
		Safe version
Sep 23, 2026	CVE-2026-5924 Getwid evaluates Google Maps customStyle as JavaScript A Contributor or higher can store attacker-controlled content in the Google Maps block's customStyle attribute. The frontend mapStyles() function evaluates that value with eval(), causing stored script to run in the site's origin when a user views the affected page. The narrative covers releases through 2.1.3; the structured version field names only 2.1.3. Affected versions: <= 2.1.3 according to the narrative (the structured field names 2.1.3). Confirmed fixed release: 2.2.0.	2.2.0	CVE6.4
Sep 22, 2025	CVE-2025-58252 Getwid: A security weakness Getwid is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Nov 20, 2024	CVE-2024-10872 Getwid – Gutenberg Blocks: Cross-site scripting Getwid – Gutenberg Blocks is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Jul 20, 2024	CVE-2024-6491 Getwid – Gutenberg Blocks: A security weakness Getwid – Gutenberg Blocks is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Jul 20, 2024	CVE-2024-6489 Getwid – Gutenberg Blocks: A security weakness Getwid – Gutenberg Blocks is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
May 02, 2024	CVE-2024-3588 Getwid – Gutenberg Blocks: Cross-site scripting Getwid – Gutenberg Blocks is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Apr 09, 2024	CVE-2024-1948 Getwid – Gutenberg Blocks: Cross-site scripting Getwid – Gutenberg Blocks is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Feb 05, 2024	CVE-2023-6963 Getwid – Gutenberg Blocks: A security weakness Getwid – Gutenberg Blocks is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Feb 05, 2024	CVE-2023-6959 Getwid – Gutenberg Blocks: A security weakness Getwid – Gutenberg Blocks is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Jun 09, 2023	CVE-2023-1910 Getwid – Gutenberg Blocks: A security weakness Getwid – Gutenberg Blocks is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Jun 09, 2023	CVE-2023-1895 Getwid – Gutenberg Blocks: Server-side request forgery Getwid – Gutenberg Blocks is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE8.5

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers