Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-26T11:16:38.210Z",
  "pubdate": "2026-08-26T11:16:38.210Z",
  "executiveSummary": "The Greenshift – animation and page builder blocks plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization within the customapi action handler. An authenticated attacker possessing at least Contributor-level privileges can inject malicious JavaScript payloads that are subsequently persisted within the WordPress database. When an administrative or privileged user views the compromised page, the malicious script executes within the context of the victim's session. This vulnerability presents a significant risk, as successful exploitation allows for unauthorized actions, session hijacking, or the defacement of the affected website. Because the payload is stored server-side, the attack does not require immediate user interaction at the time of injection, posing a persistent threat to any user who visits the affected page.",
  "technicalDetails": "The vulnerability exists within the customapi action handler provided by the Greenshift plugin in versions 12.8.9 and below. The root cause is the failure to perform rigorous output encoding or content sanitization on data retrieved from external or user-defined API responses before rendering that data to the Document Object Model (DOM) using the innerHTML property.\nThe attack flow begins when an authenticated user with Contributor-level access or higher leverages the customapi functionality. The attacker configures the plugin to fetch data from a malicious or controlled source that returns a crafted response containing embedded JavaScript tags (e.g., <script>alert(document.cookie)</script>).\nBecause the application directly assigns this unsanitized API response to an element's innerHTML property, the browser interprets the injected strings as active executable code rather than plain text. This persistence mechanism ensures that every time a user loads the affected page or post, the browser executes the stored script within the security context of the victim's session.\nThe vulnerability is particularly critical due to the privilege escalation potential; while a Contributor initiates the attack, the script executes with the permissions of any user who views the page, including site administrators. An attacker can use this to perform unauthorized administrative actions, such as creating new user accounts, modifying plugin settings, or redirecting site traffic, effectively bypassing the constraints usually imposed on the Contributor role.\nThe attack vector is characterized by the following: 1. Authentication: Required (Contributor level or higher). 2. Vulnerable Component: customapi action handler. 3. Payload Delivery: Stored via API response injection. 4. Execution: Triggered upon rendering the vulnerable block. The absence of context-aware output encoding ensures that the payload is rendered verbatim in the browser of the victim, leading to full Cross-Site Scripting execution.\nPost-exploitation impact is severe, as the attacker can steal authentication cookies, perform unauthorized API requests via the REST API or admin-ajax, and maintain persistent access to the WordPress environment without further interaction from the initial attacker."
}