The Greenshift – animation and page builder blocks plugin is vulnerable to sensitive information exposure in all versions through a nested {{COOKIE:}} placeholder injection. By sending a crafted GET request that contains a {{GET:}} placeholder referencing a key, an attacker can cause the victim’s browser to request an image URL that includes the WordPress session cookie. Because the cookie is HttpOnly, it is not interceptable through client‑side scripts, but the attacker’s host can capture it as it is transmitted as part of the image request. The vulnerability enables unauthenticated attackers to hijack the session of any logged‑in user who is tricked into opening the crafted link, without requiring administrative credentials or prior knowledge of the site’s configuration.

The flaw resides in the Greenshift WordPress plugin (animation and page builder blocks) for all releases up to and including 13.2.2. No other products or vendors are affected according to the CNA data.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, so the exploitation likelihood based on current public information is uncertain but the ability to harvest session cookies represents a serious confidentiality threat. The vulnerability is not listed in the CISA KEV catalog, yet it can be leveraged with a simple crafted link and a public GreenShift Element image block that contains a {{GET:}} placeholder. Successful exploitation requires that a site publisher has deliberately enabled such a placeholder and that a logged‑in user is induced to click a malicious URL. Given the potential for session hijacking, administrators should treat the issue as a high‑priority patchable vulnerability.