CVE-2026-4895: GreenShift WordPress Plugin XSS Vulnerability

CVE-2026-4895 Overview

The GreenShift - Animation and Page Builder Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 12.8.9. This vulnerability stems from insufficient input sanitization and output escaping in the gspb_greenShift_block_script_assets() function. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers with contributor-level permissions can inject persistent malicious JavaScript that executes in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of site visitors.

Affected Products

• GreenShift - Animation and Page Builder Blocks plugin for WordPress versions up to and including 12.8.9
• WordPress installations using vulnerable GreenShift plugin versions
• Sites where contributors have access to create or edit content using GreenShift blocks

Discovery Timeline

• April 11, 2026 - CVE-2026-4895 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4895

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the GreenShift plugin's asset handling functionality. The vulnerable gspb_greenShift_block_script_assets() function processes greenshift-blocks/image blocks and uses PHP's str_replace() function to insert fetchpriority="high" before src= attributes when the disablelazy attribute is enabled.

The fundamental issue is that the string replacement operates on raw HTML without proper parsing. When the function encounters the string src= anywhere in the HTML—including within attribute values like class names—it performs the replacement. Since the replacement string contains double quotes, this breaks out of the current attribute context, allowing injection of malicious HTML attributes.

Root Cause

The root cause is improper handling of HTML content using naive string operations instead of proper DOM parsing. The str_replace() function in PHP performs literal text replacement without understanding HTML structure or context. When the replacement string fetchpriority="high" (which contains double quotes) is inserted, it can terminate an existing attribute value and allow injection of additional attributes.

This is a classic example of CWE-79 (Improper Neutralization of Input During Web Page Generation) combined with insufficient output escaping. The function fails to validate that src= appears in an appropriate context before performing the replacement.

Attack Vector

The attack is network-based and requires authentication at the contributor level or above. An attacker can craft a malicious image block where the class attribute or other attribute values contain the string src=. When the vulnerable function processes this block, the string replacement injects double quotes that break out of the attribute context.

For example, an attacker could inject the string src= into a class attribute value. When str_replace() executes, it inserts fetchpriority="high" before this occurrence, causing the double quotes to terminate the class attribute prematurely. This allows the attacker to inject event handler attributes such as onfocus with JavaScript payloads that execute when users interact with the page element.

The stored nature of this XSS means the malicious payload persists in the WordPress database and executes every time a user views the affected page, maximizing the attack's potential impact.

Detection Methods for CVE-2026-4895

Indicators of Compromise

• Unexpected JavaScript event handlers (e.g., onfocus, onerror, onload) in GreenShift image block HTML output
• Class attributes or other HTML attributes containing suspicious src= strings followed by unexpected markup
• Malformed HTML in page content where attribute contexts appear broken or nested incorrectly
• Unusual contributor-level user activity creating or editing pages with GreenShift image blocks

Detection Strategies

• Review WordPress database content for pages containing GreenShift image blocks with suspicious attribute patterns
• Implement Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Monitor web server logs for page requests followed by unusual outbound connections or data exfiltration patterns
• Scan rendered page HTML for unexpected event handler attributes in image-related elements

Monitoring Recommendations

• Enable WordPress audit logging to track content modifications by contributor-level users
• Deploy a Web Application Firewall (WAF) with XSS detection rules tuned for stored XSS patterns
• Regularly scan WordPress installations for known vulnerable plugin versions using security scanning tools
• Monitor browser console errors and CSP violation reports for indicators of XSS exploitation attempts

How to Mitigate CVE-2026-4895

Immediate Actions Required

• Update the GreenShift - Animation and Page Builder Blocks plugin to version 12.9.0 or later immediately
• Review all pages created or modified by contributor-level users for potential malicious content injection
• Audit user roles and consider temporarily restricting contributor access until the update is applied
• Implement Content Security Policy headers to mitigate the impact of any existing injected scripts

Patch Information

The vulnerability has been patched in version 12.9.0 of the GreenShift plugin. The fix addresses the improper string replacement logic in the gspb_greenShift_block_script_assets() function. Technical details of the changes can be found in the WordPress Changeset 3494855 and the version comparison between 12.8.9 and 12.9.0.

For additional vulnerability details, see the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the GreenShift plugin if immediate patching is not possible
• Restrict contributor-level user access to prevent creation of potentially malicious content
• Avoid using the disablelazy attribute on GreenShift image blocks until the plugin is updated
• Deploy a WAF rule to sanitize or block requests containing suspicious HTML attribute injection patterns

# WordPress CLI command to update the GreenShift plugin
wp plugin update greenshift-animation-and-page-builder-blocks

# Verify installed version after update
wp plugin list --name=greenshift-animation-and-page-builder-blocks --fields=name,version,status