CVE-2026-5924

Executive Summary

CVE-2026-5924 is a stored cross-site scripting (XSS) vulnerability in the Getwid – Gutenberg Blocks plugin for WordPress, affecting all versions up to and including 2.1.3. The flaw resides in the Google Maps block's frontend JavaScript mapStyles() function, which calls eval() on user-controlled block content sourced from the customStyle attribute, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute in the context of any user viewing the affected page. While the CVSS base score is 6.4 (Medium), the scope-change property (S:C) and the stored, persistent nature of the injection elevate the practical risk for multi-author WordPress sites and membership platforms.

Technical Analysis

The vulnerability class is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically the stored (persistent) subtype. The affected component is the Getwid – Gutenberg Blocks plugin's Google Maps block. According to the NVD description, the frontend JavaScript function mapStyles() performs an eval() operation on user-controlled block content originating from the block's customStyle attribute.

The root cause is a design flaw in the JavaScript execution model. Rather than parsing the customStyle attribute as a constrained data structure (e.g., JSON-parsed style definitions validated against an allowlist), the plugin passes the attribute value directly into eval(). When eval() processes attacker-supplied strings, any JavaScript expression embedded in that string is executed in the current page context. Because the block's attribute is persisted in the WordPress post content (post meta / block serialization), the payload is stored server-side and re-executed on every page view — hence "stored" XSS rather than reflected.

The attack surface is limited to authenticated users who hold the Contributor role or above. In standard WordPress role hierarchies, Contributors can create and edit their own posts but cannot publish them; depending on site workflow configuration (e.g., editorial review plugins that render previews, or sites with relaxed publishing permissions), this still creates a viable delivery path. The CVSS vector confirms: PR:L (privileges required: Low — any authenticated user), UI:N (no user interaction required for the victim beyond visiting the page), S:C (scope changed — the injected script executes in the origin of the trusted WordPress site, not merely the plugin's namespace), C:L/I:L (limited confidentiality and integrity impact), A:N (no availability impact).

The use of eval() on attribute content that ultimately traces to a text input field is the specific anti-pattern. Notably, the NVD description does not specify how WordPress's standard KSES filtering applies here — WordPress core typically strips certain tags for Contributor-level users via unfiltered_html capability checks, but eval()-based execution occurs in the client-side JavaScript context after the content has been served, meaning sanitization of HTML entities in the post body does not neutralize JavaScript string payloads reaching eval().

Exploitation Scenarios

No public PoC or Nuclei template is available; the attack chain below is inferred strictly from the vulnerability class (stored XSS via eval()) and the specific component named in the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies a WordPress site running Getwid – Gutenberg Blocks at version 2.1.3 or lower. Detection may be performed by enumerating /wp-content/plugins/getwid/ assets or the plugin's readme.txt, or via search-engine fingerprinting of Gutenberg block markup. The attacker must possess or obtain a Contributor-level account (or higher) on the target.

2. Triggering the Flaw Class. Using the WordPress block editor (Gutenberg), the attacker inserts a Getwid Google Maps block into a draft or submitted post. The customStyle attribute of this block is a user-controllable field that reaches the frontend mapStyles() function without adequate sanitization. The attacker supplies a string whose value, when evaluated by eval(), is interpreted as JavaScript rather than inert style data.

3. Payload/Execution. The attacker stores malicious JavaScript in the customStyle attribute. When any user — including an administrator reviewing the submission or a visitor viewing the published page — loads the page containing the block, the mapStyles() function invokes eval() on that stored content, executing the attacker's script in the victim's browser under the site's origin. No public PoC exists; the precise payload construction depends on the surrounding string context in which eval() receives the attribute, which the NVD description does not disclose.

4. Post-Exploitation Impact. Because execution occurs in the trusted site origin (CVSS S:C), the script can read and manipulate page content, act on behalf of the victim in authenticated sessions (e.g., perform actions an administrator could perform), redirect users, harvest credentials via injected forms, or establish persistence in other posts. The limited C/I sub-scores reflect that impact is scoped to the browser session and the resources reachable through it.

Impact Assessment

Business impact centers on the integrity and trust of the WordPress site. Confidentiality and integrity are both rated Low (C:L, I:L), with no availability impact (A:N). The base score of 6.4 reflects a Medium severity, but the Changed Scope designation is significant: a script injected by a Contributor-level user executes with the privileges and origin of the hosting site, potentially reaching administrative sessions and external visitors. The attack is network-reachable (AV:N), requires low complexity (AC:L), and needs only low-level privileges (PR:L), with no user interaction required from the victim (UI:N).

Blast radius: any WordPress installation running Getwid – Gutenberg Blocks at ≤ 2.1.3 that permits Contributor-level content creation and renders the Google Maps block on frontend pages. Multi-author blogs, community portals, news sites with open contributor registration, and membership sites are the highest-exposure profiles. As no patch is available, the vulnerable population remains fully exposed across all deployments of the affected versions.

Detection Guidance

Sigma Rule

title: Getwid Google Maps Block Stored XSS via customStyle eval()
id: 8f3a1c2e-5924-4b7a-9d1e-getwid-xss
status: experimental
description: Detects exploitation attempts of CVE-2026-5924 via malicious customStyle attribute content in Getwid Google Maps blocks
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-5924
author: threat-intel
date: 2026/01/01
logsource:
  product: wordpress
  service: web
detection:
  selection_block:
    body|contains: 'wp:getwid/map'
  selection_attr:
    body|contains:
      - 'customStyle'
  selection_payload:
    body|contains:
      - 'eval('
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection_block and selection_attr and selection_payload
falsepositives:
  - Legitimate plugin developers testing map styles
level: high

YARA Rule

rule CVE_2026_5924_Getwid_Map_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting the Getwid Google Maps block customStyle attribute (CVE-2026-5924)"
        author = "threat-intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-5924"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $block = "getwid/map" ascii wide nocase
        $attr  = "customStyle" ascii wide nocase
        $eval  = "eval(" ascii wide nocase
        $script = "<script" ascii wide nocase
        $evt1  = "onerror=" ascii wide nocase
        $evt2  = "onload=" ascii wide nocase
        $js    = "javascript:" ascii wide nocase
    condition:
        $block and $attr and 1 of ($eval, $script, $evt1, $evt2, $js)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-5924 Getwid Google Maps Block Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"getwid/map"; nocase; http.request_body; content:"customStyle"; nocase; http.request_body; pcre:"/(eval\(|<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; reference:cve,2026-5924; sid:2026592401; rev:1;)

Elastic Detection

[any where event.category == "web" and
  (http.request.body.content : "getwid/map" or url.path : "*wp-json*") and
  http.request.body.content : "customStyle" and
  (http.request.body.content : "*eval(*" or
   http.request.body.content : "*<script*" or
   http.request.body.content : "*javascript:*" or
   http.request.body.content : "*onerror=*" or
   http.request.body.content : "*onload=*")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=wordpress
| search (uri_path="*wp-admin*" OR uri_path="*wp-json*" OR uri_path="*wp-content*")
| search (form_data="*getwid/map*" OR form_data="*customStyle*")
| rex field=form_data "(?<suspicious>eval\(|<script|javascript:|onerror=|onload=)"
| where isnotnull(suspicious)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, suspicious
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,getwid,">
  <rule id="100592" level="12">
    <if_sid>31100,31101,31103</if_sid>
    <url>wp-admin|wp-json|wp-content</url>
    <match>getwid/map|customStyle</match>
    <regex>eval\(|&lt;script|javascript:|onerror=|onload=</regex>
    <description>CVE-2026-5924: Possible stored XSS payload targeting Getwid Google Maps block detection.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no vendor patch exists, operators should (a) restrict Contributor-role content creation and require editorial review prior to publishing; (b) disable the Getwid Google Maps block site-wide via block editor settings or by deactivating the plugin entirely where the block is not required; (c) enforce a strict Content Security Policy that removes unsafe-eval and restricts script-src to trusted origins, which blocks the eval() execution vector; and (d) audit existing posts for anomalous customStyle attribute content containing eval(, <script, or event-handler strings.

2. Patch/upgrade steps. Monitor the Getwid – Gutenberg Blocks plugin repository and the vendor's advisory channel for a fixed release beyond 2.1.3. Until a patched version is published and verified, no upgrade path is available; treat all versions ≤ 2.1.3 as vulnerable and apply the compensating controls above.

3. Long-term hardening. Replace or refactor eval()-based frontend logic with structured parsing (e.g., JSON.parse with schema validation), enforce output encoding on all block attributes at render time, apply the WordPress unfiltered_html capability model consistently, and adopt a least-privilege role policy that prevents untrusted authors from injecting content into shared templates. Regularly inventory third-party Gutenberg block plugins and subscribe to CVE feeds for the WordPress ecosystem.

References

• NVD — CVE-2026-5924: https://nvd.nist.gov/vuln/detail/CVE-2026-5924
• CWE-79 Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security Documentation: https://developer.wordpress.org/plugins/security/
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE as of this report; no public PoC, Nuclei template, or exploit code is known, and the CVE is not listed in CISA KEV.