PT-2026-32087 · WordPress · Greenshift – Animation/Page Builder Blocks

Published 2026-04-11 · Updated 2026-04-18 · CVE-2026-4895

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The GreenShift - Animation and Page Builder Blocks plugin for WordPress versions up to and including 12.8.9

Description The GreenShift - Animation and Page Builder Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping within the gspb greenShift block script assets() function. The function utilizes str replace() to insert 'fetchpriority="high"' before 'src=' attributes when handling greenshift-blocks/image blocks with the disablelazy attribute enabled. This replacement operates on the entire HTML string without parsing, allowing contributors to inject the string 'src=' into HTML attribute values, such as class attributes. The execution of str replace() breaks out of the attribute context due to the double quotes in the replacement string, enabling the injection of malicious HTML attributes like onfocus with JavaScript payloads. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the injected page.

Recommendations For versions up to and including 12.8.9, ensure all input data is properly sanitized and output is correctly escaped to prevent the injection of malicious scripts. As a temporary workaround, consider disabling the greenshift-blocks/image block or the disablelazy attribute until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4895

Affected Products

Greenshift – Animation/Page Builder Blocks

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-4895 · Security Note
• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/init.php#L889 · Note
• https://twitter.com/VulmonFeeds/status/2042815246503498154 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fgreenshift-animation-and-page-builder-blocks/tags/12.8.9&new_path=%2Fgreenshift-animation-and-page-builder-blocks/tags/12.9.0 · Note
• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/init.php#L866 · Note
• https://twitter.com/atomicedgeWAF/status/2045435426211553792 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3494855/greenshift-animation-and-page-builder-blocks/trunk/init.php · Note
• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.8.6/init.php#L866 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6e3ae3c6-a7d1-46f0-a006-996c1fbe7c7e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.8.6/init.php#L889 · Note