Greenshift Animation And Page Builder Blocks
Monthly
Stored Cross-Site Scripting in the Greenshift animation and page builder blocks WordPress plugin (versions up to and including 12.8.9) allows authenticated attackers holding at minimum Contributor-level access to inject persistent malicious JavaScript via the plugin's customapi action handler. The root cause is unsanitized API response content written directly to the DOM through innerHTML in two JavaScript modules within the plugin. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthorized global theme modification in the GreenShift - Animation and Page Builder Blocks WordPress plugin (versions up to and including 12.8.9) is possible for any authenticated contributor-level user due to an insufficiently gated AJAX handler. The `gspb_update_global_wp_settings` function checks only for the `edit_posts` capability - a default contributor privilege - rather than requiring administrative rights, enabling site-wide defacement by overwriting theme color settings. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar makes this a realistic threat on any multi-author or open-registration WordPress deployment running the affected plugin.
Stored cross-site scripting in GreenShift - Animation and Page Builder Blocks plugin for WordPress up to version 12.8.9 allows authenticated contributors to inject arbitrary JavaScript into pages via improper HTML string manipulation in the gspb_greenShift_block_script_assets() function. The vulnerability exploits a naive str_replace() operation that fails to parse HTML context, enabling attackers to break out of attribute boundaries and inject malicious event handlers like onfocus with JavaScript payloads that execute when users access affected pages. No public exploit code has been identified; however, the low attack complexity and straightforward injection vector make this a practical risk for sites with untrusted contributors.
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS.8. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wp_reusable_render' shortcode due. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the Greenshift animation and page builder blocks WordPress plugin (versions up to and including 12.8.9) allows authenticated attackers holding at minimum Contributor-level access to inject persistent malicious JavaScript via the plugin's customapi action handler. The root cause is unsanitized API response content written directly to the DOM through innerHTML in two JavaScript modules within the plugin. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthorized global theme modification in the GreenShift - Animation and Page Builder Blocks WordPress plugin (versions up to and including 12.8.9) is possible for any authenticated contributor-level user due to an insufficiently gated AJAX handler. The `gspb_update_global_wp_settings` function checks only for the `edit_posts` capability - a default contributor privilege - rather than requiring administrative rights, enabling site-wide defacement by overwriting theme color settings. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar makes this a realistic threat on any multi-author or open-registration WordPress deployment running the affected plugin.
Stored cross-site scripting in GreenShift - Animation and Page Builder Blocks plugin for WordPress up to version 12.8.9 allows authenticated contributors to inject arbitrary JavaScript into pages via improper HTML string manipulation in the gspb_greenShift_block_script_assets() function. The vulnerability exploits a naive str_replace() operation that fails to parse HTML context, enabling attackers to break out of attribute boundaries and inject malicious event handlers like onfocus with JavaScript payloads that execute when users access affected pages. No public exploit code has been identified; however, the low attack complexity and straightforward injection vector make this a practical risk for sites with untrusted contributors.
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS.8. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wp_reusable_render' shortcode due. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.