The vulnerability resides in the Google Maps block of the Getwid Gutenberg Blocks plugin, where the plugin uses eval() on user‑controlled "customStyle" data in its frontend JavaScript. This flaw allows an authenticated contributor or higher to inject malicious scripts that are stored and subsequently executed in any browser that views the affected page. The impact is an uncontrolled execution of arbitrary JavaScript, leading to potential data theft, account compromise, or defacement.

WordPress sites running jetmonsters:Getwid – Gutenberg Blocks plugin, versions up to and including 2.1.3. All earlier releases are also affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of < 1 % suggests a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale public exploits. Because the attack requires at least Contributor-level access, an authenticated attacker can easily inject the payload via the block editor. The flaw is stored, meaning any visitor to a page containing the malicious block will be impacted.