CVE-2026-5092: Greenshift WordPress Plugin XSS Vulnerability

CVE-2026-5092 Overview

CVE-2026-5092 is a Stored Cross-Site Scripting (XSS) vulnerability in the Greenshift – animation and page builder blocks plugin for WordPress. The flaw affects all versions up to and including 12.8.9. The customapi action handler renders API response data through innerHTML without sufficient sanitization. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level users can persist JavaScript payloads that execute in visitor and administrator browsers, enabling session theft, forced administrative actions, and site defacement.

Affected Products

Greenshift – animation and page builder blocks plugin for WordPress
All versions up to and including 12.8.9
WordPress sites permitting Contributor-level user registration with the plugin installed

Discovery Timeline

2026-08-26 - CVE-2026-5092 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-5092

Vulnerability Analysis

The Greenshift plugin ships a customapi block that fetches remote or local API data and renders the response inside the page. The rendering path assigns the returned content directly to a DOM element's innerHTML property. Because the response body is trusted as safe markup, any HTML or <script>-equivalent constructs stored by an authenticated Contributor render as active DOM content. When a visitor loads the affected page, the browser parses and executes the attacker-controlled payload in the site's origin.

Relevant plugin source paths include libs_beauty/api/index.js (lines 406 and 777) and libs_beauty/interactionlayer/index.js (line 869), where the API response is dispatched to innerHTML. The fix ships in WordPress plugin changeset #3494855.

Root Cause

The root cause is insufficient output sanitization of dynamic API response data before DOM insertion. The plugin uses innerHTML assignment instead of safe alternatives such as textContent or a sanitizer that strips executable HTML. Contributor-level users can configure block attributes that control the API endpoint and payload, so stored values reach the client-side renderer without validation.

Attack Vector

An authenticated attacker with Contributor privileges creates or edits a post containing a Greenshift customapi block. The attacker points the block at an endpoint they control, or supplies payload data that survives server-side storage. When the post is previewed or published, the plugin retrieves the response and injects it via innerHTML. Any authenticated administrator or unauthenticated visitor viewing the page triggers the payload. Attackers commonly use this primitive to steal session cookies, hijack administrator sessions via forced requests, or pivot to account takeover.

See the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2026-5092

Indicators of Compromise

Posts or pages authored by Contributor accounts containing Greenshift customapi blocks pointing to unfamiliar external endpoints
Unexpected <script>, <iframe>, or event-handler attributes stored in wp_posts content for Greenshift blocks
Outbound requests from visitor browsers to attacker-controlled domains after visiting affected pages
New administrator accounts or role changes shortly after a Contributor publishes a customapi-containing post

Detection Strategies

Audit the wp_posts table for Greenshift block markup containing suspicious HTML tags or JavaScript URI schemes
Review WordPress activity logs for Contributor accounts creating or editing pages that reference the customapi block
Inspect web server logs for cross-origin API calls initiated from Greenshift block configurations
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on plugin-rendered pages

Monitoring Recommendations

Enable WordPress audit logging to capture post creation, editing, and role modification events
Alert on outbound HTTP fetches to previously unseen domains referenced by Greenshift blocks
Track privilege changes to detect follow-on account takeover after XSS execution
Deploy runtime endpoint telemetry on administrator workstations to identify anomalous browser-initiated actions against the WordPress admin console

How to Mitigate CVE-2026-5092

Immediate Actions Required

Update the Greenshift plugin to a version later than 12.8.9 that includes changeset #3494855
Audit all Contributor, Author, and Editor accounts and remove accounts that are unnecessary or inactive
Review recent posts containing Greenshift customapi blocks and sanitize or remove suspicious content
Rotate administrator session cookies and force password resets for privileged accounts if exploitation is suspected

Patch Information

The vendor addressed the vulnerability in the plugin release following version 12.8.9 through WordPress plugin changeset #3494855. The patch modifies API response handling in libs_beauty/api/index.js and libs_beauty/interactionlayer/index.js to sanitize output before DOM insertion. Site administrators should apply the update through the WordPress plugin manager or wp-cli.

Workarounds

Disable the Greenshift plugin until the patched version is deployed
Restrict Contributor-level registration and require editorial review before publishing posts that contain Greenshift blocks
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources
Deploy a web application firewall rule set that filters <script> and event-handler payloads in POST bodies to the WordPress REST API

bash

# Update the plugin using wp-cli
wp plugin update greenshift-animation-and-page-builder-blocks

# Verify installed version is above 12.8.9
wp plugin get greenshift-animation-and-page-builder-blocks --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate greenshift-animation-and-page-builder-blocks