The GreenShift plugin for WordPress is affected by a stored XSS flaw. The vulnerability originates in the gspb_greenShift_block_script_assets() function, which inserts a string before 'src=' attributes without parsing or escaping the HTML. An authenticated user with contributor‑level or higher permissions can embed the text 'src=' into attribute values, such as a class attribute. When the replacement runs, the double quotes inside the injected string split the attribute context, enabling the attacker to add malicious attributes including JavaScript event handlers. The injected code is stored with the block and will run whenever the page is viewed, enabling hijacking of sessions, credential theft, or phishing. This weakness conforms to CWE‑79 and gives the attacker the ability to execute arbitrary scripts on any visitor’s browser.

Any WordPress site that has the Greenshift – Animation and Page Builder Blocks plugin installed in version 12.8.9 or earlier is vulnerable. Users who have contributor or higher capabilities can add or modify blocks, making them an attack vector. The flaw affects all sites still running these legacy plugin versions.

The CVSS base score of 6.4 reflects a medium severity vulnerability. No EPSS score or public exploit is currently documented, and the issue is not listed in CISA’s KEV catalog. Nonetheless, exploitation only requires authenticated access to the WordPress administration area and the ability to edit blocks. By inserting a malicious block or altering an existing one, an attacker can persist the script in stored content. The risk to site visitors is that any who load the affected page will execute the injected JavaScript, potentially compromising user data or the site’s integrity.