Executive brief
Greenshift is a WordPress page builder plugin that provides animation and block functionality for site content. The plugin improperly escapes user input in animation configuration attributes, allowing users with contributor-level access to inject malicious scripts that execute when site administrators or visitors view the content. This can lead to session hijacking, data theft, or website defacement.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the block animation feature (CWE-79). The root cause is improper HTML escaping of the animation.customProps, animation.customPropsM, and animation.multianimations attributes before they are output in HTML attributes. An authenticated user with contributor-level or higher privileges can craft a malicious post via the REST API containing a Greenshift block with a payload that breaks out of the attribute context (e.g., x" onmouseover=alert(document.domain) style=position:fixed;inset:0 y="). When an editor, administrator, or any site visitor views the post, the injected JavaScript executes in their browser. The plugin versions affected are 13.1.9 and earlier; the fix is available in version 13.2.0.
Affected products
- Greenshift Greenshift before 13.2.0
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fix released in version 13.2.0
- 2026-09-05: advisory