Junglewise Threat Intelligence

CVE-2026-4895: GreenShift Animation and Page Builder Blocks Stored XSS

CVE-2026-4895 · Severity: medium · CVSS 6.4 · Published 2026-04-11

Executive brief

The GreenShift plugin for WordPress, which provides animation and page-building tools, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on behalf of visitors or the theft of sensitive session information.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the gspb_greenShift_block_script_assets() function. The root cause is the unsafe use of str_replace() to inject 'fetchpriority' attributes into HTML strings without proper parsing or context-aware escaping. An authenticated attacker with contributor-level permissions can craft a block containing the string 'src=' within a non-URL attribute (like a CSS class). When the plugin attempts to modify the image block, the replacement string breaks out of the HTML attribute context, allowing the injection of arbitrary event handlers (e.g., onfocus) and JavaScript payloads. The issue is fixed in version 12.9.0.

Affected products

  • GreenShift GreenShift - Animation and Page Builder Blocks Up to and including 12.8.9

Timeline

  • 2026-04-10: disclosed: Initial disclosure by Wordfence
  • 2026-04-11: advisory: NVD publication date

References