CVE-2026-93880

Overview

The Greenshift WordPress plugin is vulnerable to reflected XSS via unsanitized {{GET:}} placeholders. Attackers can inject scripts into pages if the Custom JS field contains a {{GET:...}} placeholder and the JS includes 'import'. This allows unauthenticated users to execute arbitrary code in the victim's browser.

Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a

Impact

Confidentiality: malicious scripts can exfiltrate data from the victim's browser. Integrity: attackers can modify page content or inject malicious content. Availability: minimal impact. Impacted parties: site administrators, site visitors, and any users who view affected pages.

Remediation

Update to version 13.3.0 or later. If an update is not possible, disable the Custom JS field or remove any {{GET:}} placeholders. Ensure all user input is properly sanitized and output is escaped. Deploy a web application firewall to block XSS payloads.

Risk context

Medium severity with a low EPSS (0.00211) indicates a low likelihood of exploitation but still warrants timely patching to prevent potential XSS attacks.

Affected products

• Greenshift WordPress plugin