WordPress Plugin Vulnerabilities

Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute

Description

The plugin does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

Proof of Concept

Affects Plugins

Plugin icon
greenshift-animation-and-page-builder-blocks
Fixed in 13.2.0

References

CVE
CVE-2026-83544

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
f2bd202b-43fc-4ca7-9bab-649ed87e7cbd

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2023-12-16
Title
Jquery news ticker < 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2026-02-05
Title
Court Reservation <= 1.10.8 - Reflected Cross-Site Scripting
Published
2024-01-31
Title
Beds24 Online Booking < 2.0.24 - Authenticated(Administrator+) Stored Cross-Site Scripting
Published
2026-04-21
Title
WPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2025-12-21
Title
Google AdSense for Responsive Design – GARD <= 2.23 - Authenticated (Administrator+) Stored Cross-Site Scripting