Executive brief
Greenshift is a popular WordPress plugin that adds animation and custom page building functionality. A vulnerability in the plugin allows authenticated users with Contributor access to inject malicious scripts that execute when site visitors view affected pages, potentially compromising user sessions or stealing sensitive data.
Technical details
The plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the customapi action handler due to insufficient sanitization of API responses before they are rendered via innerHTML. An authenticated attacker with Contributor-level permissions or higher can craft a malicious API response that injects arbitrary JavaScript code. The injected script persists in the database and executes in the browsers of all users who access the affected page. The vulnerability affects versions up to and including 12.8.9.
Affected products
- Greenshift animation and page builder blocks up to and including 12.8.9
Timeline
- 2026-08-26: disclosed