WordPress Plugin Vulnerabilities

Greenshift – animation and page builder blocks < 4.8.9 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

Proof of Concept

Affects Plugins

Plugin icon
greenshift-animation-and-page-builder-blocks
Fixed in 4.8.9

References

CVE
CVE-2022-4653

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
fa44ed44-9dac-4b4f-aaa3-503b76034578

Timeline

Publicly Published
2022-12-23 (about 3 years ago)
Added
2022-12-23 (about 2 years ago)
Last Updated
2022-12-23 (about 2 years ago)

Other

Published
Title
Published
2017-05-16
Title
WordPress 3.3-4.7.4 - Large File Upload Error XSS
Published
2025-02-17
Title
WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-01-11
Title
Custom Global Variables < 1.1.1 - Stored Cross-Site Scripting (XSS)
Published
2023-01-23
Title
Image and Video Lightbox, Image PopUp < 2.1.6 - Admin+ Stored XSS
Published
2015-11-11
Title
Profile Builder < 2.2.5 - XSS