# CVE-2026-83544: Greenshift WordPress plugin stored XSS in block animation

Source: https://junglewise.ai/threats/cve-2026-83544-greenshift-wordpress-plugin-stored-xss-in-block-animation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83544 · Severity: medium · CVSS 6.8 · Published 2026-09-05

Greenshift is a WordPress page builder plugin that provides animation and block functionality for site content. The plugin improperly escapes user input in animation configuration attributes, allowing users with contributor-level access to inject malicious scripts that execute when site administrators or visitors view the content. This can lead to session hijacking, data theft, or website defacement.

Vendors: [Greenshift](https://junglewise.ai/threats/vendors/greenshift).

## Quick answers

**Is CVE-2026-83544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83544 being exploited in the wild.

**How severe is CVE-2026-83544?** Medium severity, with a CVSS score of 6.8, published 5 September 2026.

**Which products and versions are affected?** Greenshift before 13.2.0.

**Is there a fix for CVE-2026-83544?** A patch was published on 2026-09-05: Fix released in version 13.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83544 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-83544?** Check whether you run Greenshift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the block animation feature (CWE-79). The root cause is improper HTML escaping of the animation.customProps, animation.customPropsM, and animation.multianimations attributes before they are output in HTML attributes. An authenticated user with contributor-level or higher privileges can craft a malicious post via the REST API containing a Greenshift block with a payload that breaks out of the attribute context (e.g., x" onmouseover=alert(document.domain) style=position:fixed;inset:0 y="). When an editor, administrator, or any site visitor views the post, the injected JavaScript executes in their browser. The plugin versions affected are 13.1.9 and earlier; the fix is available in version 13.2.0.

## Affected products

- Greenshift Greenshift before 13.2.0

## Timeline

- 2026-09-03: disclosed
- 2026-09-05: patched: Fix released in version 13.2.0
- 2026-09-05: advisory

## References

- [https://wpscan.com/vulnerability/f2bd202b-43fc-4ca7-9bab-649ed87e7cbd/](https://wpscan.com/vulnerability/f2bd202b-43fc-4ca7-9bab-649ed87e7cbd/)

## Related threats

- [Greenshift WordPress plugin SSRF in REST endpoint](https://junglewise.ai/threats/cve-2026-83543-greenshift-wordpress-plugin-ssrf-in-rest-endpoint)