WordPress users of the Greenshift plugin are exposed to a stored Cross‑Site Scripting flaw caused by the plugin’s failure to properly neutralize user‑supplied input before rendering it in a web page. The likely attack vector involves an attacker or compromised user inserting malicious script into input fields that Greenshift stores and subsequently displays, enabling execution of arbitrary JavaScript in the browsers of site visitors. This can lead to session hijacking, credential theft, defacement, or further compromise of the affected WordPress site.

All installations of the wpsoul Greenshift plugin through version 11.0.2 are affected. Any WordPress site running this plugin, regardless of the WordPress core version, is vulnerable if the plugin has not been patched to 11.0.3 or later.

The vulnerability carries a CVSS score of 6.5, reflecting moderate severity, and an EPSS score of less than 1%, indicating a low probability of widespread exploitation at present. It is not listed in the CISA KEV catalog. Exploitability generally requires access to an interface where users can create or edit content via Greenshift, meaning an attacker would likely need a user account with editing privileges. Once an injection succeeds, the impact is confined to individuals who view the affected page, but the threat to attackers is amplified by the remote, script‑based nature of the payload.