6.4
MediumCVSS 3.1 · from Wordfence
CVE-2026-5092
Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
Greenshift – animation and page builder blocks · Cross-site scripting · CWE-79AffectedGreenshift – animation and page builder blocks
FixNo fix listed yet.
PublishedAug 26, 11:05 · Wordfence
ScoredAug 26 · 6.4 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
From Wordfence
Affected and fixed versions
ProductAffectedFixed inGreenshift – animation and page builder blocksup to 12.8.9–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known