CVE-2026-93880 in Greenshift Plugin
Summary
by MITRE • 10/02/2026
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The Greenshift animation and page builder plugin for WordPress, specifically in versions up through 13.2.0, contains a critical reflected cross-site scripting vulnerability rooted in inadequate input sanitization and output escaping mechanisms. This flaw is triggered by the handling of dynamic placeholders denoted as GET parameters within custom JavaScript fields configured by site administrators. The core technical issue arises when an administrator configures an element block to include a placeholder that retrieves data directly from HTTP request query strings, such as {{GET:parameter_name}}. While this feature allows for dynamic content insertion based on user input or URL parameters, the plugin fails to properly validate or encode these values before they are processed and rendered within the page structure.
The vulnerability is particularly severe because it exploits a specific code path involving JavaScript modules. When the custom JS field contains the token import, which is used in modern web development for loading external scripts or modules, the application routes the substituted value into an unescaped raw echo branch inside a script tag with type module. This architectural decision means that any data injected via the GET parameter is executed directly as part of the JavaScript context without being sanitized against special characters or encoded to prevent interpretation as executable code. Consequently, if an attacker can manipulate the query string parameters associated with this placeholder, they can inject arbitrary web scripts into the page content served to visitors.
From a security operations perspective, this vulnerability allows unauthenticated attackers to perform reflected cross-site scripting attacks without requiring prior authentication credentials for the WordPress site itself. However, successful exploitation does depend on specific configuration prerequisites set by the website administrator. The attacker must trick a victim user into clicking a link where the URL contains maliciously crafted query parameters that match the expected format of the dynamic placeholder. Once clicked, the browser interprets the injected script within the module context, leading to potential session hijacking, credential theft via keyloggers, defacement of the website content, or redirection to phishing sites. The impact is significant because it compromises the integrity and confidentiality of user interactions with the affected WordPress site.
This vulnerability aligns closely with CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting flaw. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving client-side code injection and potentially exploitation via social engineering through link manipulation. The attack vector is classified as remote with low complexity but requires user interaction, placing it firmly in the realm of reflected XSS attacks where the malicious payload is not stored on the server but executed immediately upon request processing.
To mitigate this risk, immediate action should be taken by administrators using affected versions of the Greenshift plugin. The most effective remediation strategy is to upgrade the plugin to a version later than 13.2.0, provided that the developers have released patches addressing these specific sanitization and escaping issues. Until an update is available or if upgrading is not immediately feasible, site owners should audit their configurations for any custom JS fields utilizing {{GET:...}} placeholders. It is advisable to remove such dynamic placeholder usage from JavaScript contexts entirely, especially those involving module imports, as the risk of script injection outweighs the functional benefit in most standard use cases. Additionally, implementing a Web Application Firewall with robust XSS detection rules can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Regular security audits and adherence to secure coding practices that mandate strict output encoding for all dynamic content are essential preventive measures against similar vulnerabilities in future development cycles.