CVE-2026-83544: Greenshift WordPress Plugin XSS Vulnerability

CVE-2026-83544 Overview

CVE-2026-83544 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Greenshift WordPress plugin. Versions prior to 13.2.0 fail to escape a block animation attribute before rendering it inside an HTML attribute context. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when the affected content is viewed by other users, including administrators.

Critical Impact
Contributor-level attackers can persist JavaScript payloads inside post content, enabling session theft, forced administrative actions, and account takeover when higher-privileged users render the page.

Affected Products

Greenshift WordPress plugin versions prior to 13.2.0
WordPress sites that allow contributor-level or higher user registration
Any site rendering Greenshift blocks with animation attributes

Discovery Timeline

2026-09-05 - CVE-2026-83544 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-83544

Vulnerability Analysis

The Greenshift plugin extends WordPress with Gutenberg blocks that support animation attributes. When a block is rendered, the plugin outputs the animation attribute value inside an HTML attribute without applying proper escaping. Because the value is user-controllable through the block editor, an attacker can break out of the attribute context and inject script content.

The issue falls under Improper Neutralization of Input During Web Page Generation [CWE-79]. Exploitation requires an authenticated account with contributor-level access, but WordPress sites frequently grant this role to guest authors, freelancers, and community contributors. The injected payload persists in the database and executes each time the content is viewed.

Root Cause

The plugin passes block animation attribute values directly into HTML output without calling WordPress escaping helpers such as esc_attr(). Any characters that terminate an HTML attribute — quotes, angle brackets, or event handler syntax — are rendered verbatim, allowing script execution in the viewer's browser session.

Attack Vector

An attacker with contributor privileges authors a post or page containing a Greenshift block. The animation attribute is modified to carry a JavaScript payload that closes the surrounding attribute and introduces a new event handler. When an editor, administrator, or visitor loads the rendered content, the browser executes the payload under the site's origin. The attacker can then exfiltrate session cookies, perform actions as the viewing user, or plant persistence such as new administrator accounts.

See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-83544

Indicators of Compromise

Greenshift block markup in wp_posts containing HTML attribute delimiters, on*= event handlers, or javascript: URIs inside animation attribute values
Unexpected outbound requests from editor or administrator browser sessions shortly after viewing contributor-authored content
New administrator accounts or modified user roles created by sessions originating from editor workstations

Detection Strategies

Audit installed Greenshift versions across all WordPress sites and flag any instance below 13.2.0
Query the post database for Greenshift blocks whose animation attributes contain <, >, ", or script substrings
Review recent posts and revisions submitted by contributor-role users for suspicious block attributes

Monitoring Recommendations

Enable WordPress audit logging for post creation, post updates, and role changes
Alert on privilege escalation events and unexpected administrator account creation
Monitor web server logs for anomalous requests to wp-admin endpoints originating from browsers that recently rendered contributor content

How to Mitigate CVE-2026-83544

Immediate Actions Required

Upgrade the Greenshift plugin to version 13.2.0 or later on every WordPress site where it is installed
Review contributor and author accounts, removing any that are inactive or unnecessary
Inspect posts and pages authored by contributors for malicious Greenshift block attributes and purge affected content

Patch Information

The vendor addressed the flaw in Greenshift 13.2.0 by properly escaping the block animation attribute before HTML output. Refer to the WPScan Vulnerability Report for advisory details and update guidance.

Workarounds

Restrict contributor-level and higher access to trusted users until the plugin is updated
Temporarily disable the Greenshift plugin on sites that accept untrusted contributor submissions
Deploy a web application firewall rule that blocks block attribute payloads containing HTML control characters

bash

# Update Greenshift via WP-CLI
wp plugin update greenshift-animation-and-page-builder-blocks --version=13.2.0
wp plugin list --name=greenshift-animation-and-page-builder-blocks