Reflected Cross-Site Scripting in Greenshift Animation Plugin for WordPress

CVE-2026-93880

What is CVE-2026-93880?

The Greenshift animation and page builder blocks plugin for WordPress is vulnerable to a Reflected Cross-Site Scripting (XSS) issue due to inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 13.2.0. Attackers can exploit this flaw by injecting arbitrary scripts into web pages, leading to potential malicious code execution if victims are tricked into clicking on specially crafted links. The vulnerability is specifically tied to the '{{GET:}}' dynamic placeholder, which must be configured in an element block's Custom JS field, including the token 'import.' This allows the unescaped substituted value to be processed within a <script type="module"> tag, significantly raising the risk of script injection attacks.

References