CVE-2026-93880
MediumCVSS 6.1Summary
The Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 13.2.0) is vulnerable to Reflected Cross-Site Scripting via the '{{GET:}}' Dynamic Placeholder. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts that execute when a user is tricked into clicking a crafted link.
Risk Assessment
This requires a site administrator to have configured an element block's Custom JS field with a {{GET:...}} placeholder containing the token 'import', causing the injected script to run in the victim's browser and potentially leading to session theft or account takeover.
Recommendation
Update the Greenshift plugin to a version later than 13.2.0 and review Custom JS block configurations for unsafe {{GET:...}} placeholders.
Other vulnerabilities in Greenshift WordPress Plugin
See all- CVE-2026-83544Medium
The Greenshift WordPress plugin before version 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- CVE-2026-83543Medium
The Greenshift WordPress plugin before version 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
Original NVD description (English source)
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS