CVE-2025-11841: Greenshift WordPress Plugin XSS Vulnerability

CVE-2025-11841 Overview

The Greenshift animation and page builder blocks plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in its Chart Data attributes. The flaw affects all plugin versions up to and including 12.2.7. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any visitor who views the affected page, including administrators. The vulnerability is tracked under CWE-79 and was disclosed through a Wordfence Vulnerability Report.

Critical Impact
Authenticated contributors can store arbitrary JavaScript in chart attributes, leading to session hijacking, account takeover, or administrative action abuse when victims view the page.

Affected Products

Greenshift – animation and page builder blocks plugin for WordPress
All versions up to and including 12.2.7
WordPress sites allowing Contributor-level accounts or higher

Discovery Timeline

2025-11-04 - CVE-2025-11841 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-11841

Vulnerability Analysis

The Greenshift plugin provides block-based page building features for WordPress, including chart components backed by configurable data attributes. The Chart Data attributes accept user-supplied values that are stored in post content and later rendered in the browser. The plugin fails to sanitize input before storage and does not escape output when rendering, allowing attacker-controlled markup and script tags to persist in the database and execute in viewers' browsers.

Stored XSS in a page builder context is particularly impactful because malicious payloads survive across sessions and are triggered automatically on page load. Any user viewing an affected page, including site administrators, executes the attacker's script in the context of the WordPress origin. This can be chained with privileged operations exposed through the WordPress REST API to escalate the Contributor-level foothold toward full site compromise.

Root Cause

The root cause is missing input sanitization on the Chart Data attributes combined with missing output escaping during rendering. The plugin trusts attribute values submitted by authenticated editors and emits them into the page without applying wp_kses_post, esc_attr, or equivalent context-aware escaping. The upstream fix is published in the WordPress Plugin Changeset 3386004.

Attack Vector

An attacker with Contributor-level access or above authenticates to the WordPress dashboard, creates or edits a post, and inserts a Greenshift chart block. The attacker then populates the Chart Data attributes with a payload containing JavaScript. When the post is previewed or published and viewed by any user, the injected script executes under the site's origin. No user interaction beyond navigating to the page is required for the payload to run.

No verified public proof-of-concept code is available at the time of writing. See the Wordfence advisory for additional technical context.

Detection Methods for CVE-2025-11841

Indicators of Compromise

Greenshift chart blocks containing <script>, onerror=, onload=, or javascript: strings inside Chart Data attributes.
Post revisions authored by Contributor-level accounts introducing Greenshift chart blocks with unusual attribute payloads.
Outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts containing Greenshift charts.
New administrator accounts, altered user roles, or unexpected plugin installations following viewing of a compromised page.

Detection Strategies

Query the wp_posts table for post_content entries referencing Greenshift chart blocks and inspect their attribute JSON for script-like tokens.
Review WordPress audit logs for Contributor and Author accounts creating or editing posts that embed chart blocks.
Monitor browser Content Security Policy (CSP) violation reports for inline script execution originating from WordPress pages.

Monitoring Recommendations

Enable a web application firewall (WAF) rule set that flags stored XSS payloads submitted through the WordPress REST API /wp/v2/posts endpoint.
Alert on privilege changes, option updates, and plugin installations occurring immediately after administrator sessions load pages containing Greenshift blocks.
Track plugin version inventory across managed WordPress sites and alert when Greenshift versions at or below 12.2.7 are detected.

How to Mitigate CVE-2025-11841

Immediate Actions Required

Update the Greenshift plugin to a version newer than 12.2.7 that includes the fix from changeset 3386004.
Audit existing posts and pages containing Greenshift chart blocks for malicious script content and remove any injected payloads.
Review Contributor, Author, and Editor accounts, disable unused accounts, and rotate credentials where suspicious activity is observed.
Force-reauthenticate all administrators and invalidate active WordPress sessions after cleanup.

Patch Information

The vulnerability is addressed in the Greenshift plugin version released after 12.2.7. The source code fix is documented in WordPress Plugin Changeset 3386004. Administrators should apply the update through the WordPress plugin management interface or by deploying the patched release through their configuration management system.

Workarounds

Restrict Contributor and higher roles to trusted users only until the patched plugin version is deployed.
Temporarily disable the Greenshift plugin on sites where immediate patching is not possible.
Deploy a WAF rule to block requests containing <script> or event-handler attributes targeting Greenshift block endpoints.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS execution.

bash

# Configuration example: update Greenshift via WP-CLI
wp plugin update greenshift-animation-and-page-builder-blocks
wp plugin get greenshift-animation-and-page-builder-blocks --field=version