Stored DOM-Based Cross-Site Scripting in Greenshift Plugin for WordPress

CVE-2026-119218

What is CVE-2026-119218?

The Greenshift plugin for WordPress is susceptible to Stored DOM-Based Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability can be exploited by unauthenticated attackers through the 'url (comment_author_url)' parameter in versions up to and including 13.2.2. If the affected page is configured with a specific GreenShift Interaction Layer attach-attribute action, it can allow attackers to inject malicious web scripts into pages. Once a comment containing the payload is published, it triggers the execution of the script on every visitor's session when they load the affected page into their viewport.

References