The Greenshift – animation and page builder blocks plugin contains a Stored XSS flaw caused by the Chart Data attributes that fail to sanitize input or escape output. Authenticated users with Contributor privileges or higher can submit arbitrary scripts through these attributes, which are then persisted and served on any page containing the chart. When an unsuspecting user views the affected page, the embedded script executes in that user’s browser, potentially allowing injection of malicious code, theft of credentials, defacement, or other forms of user‑targeted exploitation.

WordPress plugin Greenshift – animation and page builder blocks, all releases up to and including version 12.2.7.

The vulnerability received a CVSS score of 6.4, placing it in the medium severity range. An EPSS score of less than 1% indicates a very low public exploit probability at the time of this analysis, and the flaw is not listed in the CISA KEV catalog. Likely attack vectors involve an authenticated attacker logging into the WordPress administration area, creating or editing a page or post that uses the chart block, and inserting malicious JavaScript into the chart data fields. The stored script would then trigger when any visitor loads the page, providing the attacker with persistent, cross‑site execution capabilities.