WP-Safety
CVE-2026-2593

Greenshift – animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
12.8.6
Patched in
1d
Time to patch

Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_gspb_post_css` post meta value and the `dynamicAttributes` block attribute in all versions up to, and including, 12.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=12.8.5
PublishedMarch 5, 2026
Last updatedMarch 5, 2026
Affected plugingreenshift-animation-and-page-builder-blocks

What Changed in the Fix

Changes introduced in v12.8.6

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v12.8.5
Browse source Download .zip
Patched v12.8.6
Browse source Download .zip
Research Plan
Unverified

This research plan outlines the steps to exploit a Stored Cross-Site Scripting (XSS) vulnerability in the Greenshift plugin. The vulnerability stems from insufficient sanitization of block attributes (`dynamicAttributes`) and post meta (`_gspb_post_css`) when rendered by the `greenshift-blocks/eleme…

Show full research plan

This research plan outlines the steps to exploit a Stored Cross-Site Scripting (XSS) vulnerability in the Greenshift plugin. The vulnerability stems from insufficient sanitization of block attributes (dynamicAttributes) and post meta (_gspb_post_css) when rendered by the greenshift-blocks/element block.

1. Vulnerability Summary

  • ID: CVE-2026-2593
  • Vulnerability: Authenticated (Contributor+) Stored XSS.
  • Location: blockrender/element/block.php (specifically render_block) and init.php.
  • Sink: The render_block function uses greenshift_dynamic_placeholders to fetch data from meta or block attributes and injects the results into the page's HTML. It fails to escape the final output when processing dynamic content for the textContent or other attributes of the "Element" block.
  • Source: Block attributes (dynamicAttributes) or post meta (_gspb_post_css) controlled by a Contributor-level user.

2. Attack Vector Analysis

  • Endpoint: WordPress REST API (for post creation/update) or Greenshift AJAX endpoints.
  • Role Required: Contributor or higher.
  • Preconditions: The Greenshift plugin must be active.
  • Vector 1 (Block Attribute): Injecting XSS directly into the dynamicAttributes attribute of a greenshift-blocks/element block within the post content.
  • Vector 2 (Post Meta): Injecting XSS into the _gspb_post_css meta field and referencing it via a dynamic placeholder (e.g., {{meta:_gspb_post_css}}).

3. Code Flow

  1. Entry: A Contributor saves a post containing a greenshift-blocks/element block.
  2. Processing: When the post is viewed, WordPress calls the block's render_callback, which is greenshiftaddon\Blocks\Element::render_block in blockrender/element/block.php.
  3. Dynamic Fetch: render_block retrieves attributes from $block['attrs']. If `dynamic
Research Findings
Static analysis — not yet PoC-verified

Summary

The Greenshift plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping of the dynamicAttributes block attribute and certain post meta values. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary scripts into pages that execute when users view the affected content.

Vulnerable Code

// blockrender/element/block.php around line 660
				}else{
					$sanitized_value = sanitize_text_field($value['value']);
					$dynamicAttributes[$index]['value'] = greenshift_dynamic_placeholders($sanitized_value);
					if(!empty($dynamicAttributes[$index]['name']) && strpos($dynamicAttributes[$index]['name'], 'on') === 0){
						$dynamicAttributes[$index]['value'] = '';
					}
				}

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/greenshift-animation-and-page-builder-blocks/12.8.5/blockrender/element/block.php /home/deploy/wp-safety.org/data/plugin-versions/greenshift-animation-and-page-builder-blocks/12.8.6/blockrender/element/block.php
--- /home/deploy/wp-safety.org/data/plugin-versions/greenshift-animation-and-page-builder-blocks/12.8.5/blockrender/element/block.php	2026-02-27 01:27:12.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/greenshift-animation-and-page-builder-blocks/12.8.6/blockrender/element/block.php	2026-03-04 16:14:42.000000000 +0000
@@ -241,6 +241,19 @@
 						}
 					}
 				}
+			} else if($block['attrs']['tag'] == 'img'){
+				if(!empty($block['attrs']['src']) && strpos($block['attrs']['src'], '{{') !== false){
+					$p = new \WP_HTML_Tag_Processor( $html );
+					$p->next_tag();
+					$p->set_attribute( 'src', esc_url(greenshift_dynamic_placeholders($block['attrs']['src'])));
+					$html = $p->get_updated_html();
+				}
+				if(!empty($block['attrs']['alt']) && strpos($block['attrs']['alt'], '{{') !== false){
+					$p = new \WP_HTML_Tag_Processor( $html );
+					$p->next_tag();
+					$p->set_attribute( 'alt', greenshift_dynamic_placeholders(esc_attr($block['attrs']['alt'])));
+					$html = $p->get_updated_html();
+				}
 			}
 		}
 
@@ -660,7 +673,7 @@
 				}else{
 					$sanitized_value = sanitize_text_field($value['value']);
 					$dynamicAttributes[$index]['value'] = greenshift_dynamic_placeholders($sanitized_value);
-					if(!empty($dynamicAttributes[$index]['name']) && strpos($dynamicAttributes[$index]['name'], 'on') === 0){
+					if(!empty($dynamicAttributes[$index]['name']) && stripos($dynamicAttributes[$index]['name'], 'on') === 0){
 						$dynamicAttributes[$index]['value'] = '';
 					}
 				}

Exploit Outline

The exploit requires Contributor-level authentication to create or edit a post. An attacker can use the WordPress REST API or the block editor to insert a 'greenshift-blocks/element' block. The attacker then populates the 'dynamicAttributes' attribute of the block with a payload. Because the plugin used a case-sensitive check (strpos) for 'on' event handlers, an attacker could bypass the filter using mixed-case event names like 'OnClick' or 'OnMouseOver'. Alternatively, the attacker can use dynamic placeholders like '{{meta:_gspb_post_css}}' to pull content from post meta that contains malicious JavaScript. When a site visitor or administrator views the post, the renderer processes these placeholders and injects the raw, unescaped output into the page's HTML structure, triggering the XSS.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/57b7b171-cd25-4bcd-aa75-3ccbfbb1452a?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database