CVE-2026-83544
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Greenshift WordPress plugin before version 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
Risk Assessment
An attacker can execute malicious scripts in a victim's browser, potentially leading to session theft, account takeover, or distribution of malicious content.
Recommendation
Update the Greenshift plugin to version 13.2.0 or later, which includes the security fix.
Other vulnerabilities in Greenshift WordPress plugin
See all- CVE-2026-93880Medium
The Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 13.2.0) is vulnerable to Reflected Cross-Site Scripting via the '{{GET:}}' Dynamic Placeholder. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts that execute when a user is tricked into clicking a crafted link.
- CVE-2026-83543Medium
The Greenshift WordPress plugin before version 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
Original NVD description (English source)
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS