CVE-2025-49301

WordPress Greenshift plugin <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability

Published Jun 6, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.

Analysis

Technical impact

Improper neutralization of input during web page generation in the Greenshift animation and page‑builder blocks plugin permits a DOM‑based cross‑site scripting flaw (CWE‑79). This vulnerability allows the execution of arbitrary JavaScript in the context of a user’s browser when the plugin renders content.

Affected Systems

WordPress sites that use the Greenshift plugin version 11.5.5 or earlier are affected. The vulnerability applies to all releases from the earliest build through and including 11.5.5.

Risk and Exploitability

The CVSS rating of 6.5 indicates moderate severity, and the EPSS score of less than 1 % signifies a low probability of exploitation. The vulnerability is not listed in CISA KEV. It is inferred that the attack vector is client‑side, where an attacker can supply crafted content that is rendered by the plugin, triggering the DOM‑based XSS; no server‑side privileges are required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wpsoul

Greenshift

unaffected

Version	Status	Constraints
`0`	affected	≤ 11.5.5

No data.

Vendor	Product	Versions
Wpsoul	Greenshift	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Greenshift plugin to any version newer than 11.5.5 to apply the vendor‑supplied fix.
Ensure that any user‑supplied content handled by the plugin is properly sanitized or escaped before rendering to prevent injection of JavaScript.
Deploy a Content Security Policy that disallows inline scripts and restricts the sources of executable code to trusted origins, limiting the impact of any remaining XSS execution.

Generated by OpenCVE AI on May 2, 2026 at 01:28 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-17265	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows DOM-Based XSS. This issue affects Greenshift: from n/a through 11.5.5.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.269% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-11-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows DOM-Based XSS. This issue affects Greenshift: from n/a through 11.5.5.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.
Title	WordPress Greenshift <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability	WordPress Greenshift plugin <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability
References	https://patchstack.com/database/wordpress/plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-11-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-11-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Jun 6, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 6, 2025 1:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows DOM-Based XSS. This issue affects Greenshift: from n/a through 11.5.5.
Title		WordPress Greenshift <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-11-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`