Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder

Greenshift – animation and page builder blocks · Cross-site scripting · CWE-79

AffectedGreenshift – animation and page builder blocks

FixNo fix listed yet.

PublishedOct 2, 07:39 · Wordfence

ScoredOct 2 · 6.1 · Wordfence

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inGreenshift – animation and page builder blocksup to 13.2.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.wordfence.com/threat-intel/vulnerabilities/id/133a7a71-4428-4ada-8ed7-a7c6fe54a0cb?source=cve · wordfence.com plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.0/blockrender/element/block.php#L868 · plugins.trac.wordpress.org plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.0/includes/helper.php#L1381 · plugins.trac.wordpress.org plugins.trac.wordpress.org/changeset?reponame=&old=3714657%40greenshift-animation-and-page-builder-blocks&new=3714657%40greenshift-animation-and-page-builder-blocks · plugins.trac.wordpress.org

Other CVEs in Greenshift – animation and page builder blocks

All 14 →

5.4Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block · CVE-2026-107627Oct 29 5.4Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText · CVE-2026-107629Oct 29 6.4Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI · CVE-2026-5092Aug 26