CVE-2026-83544
Received Received - Intake

Stored XSS in Greenshift WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-83544
EUVD
EUVD-2026-71859

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
greenshift wordpress_plugin to 13.2.0 (exc)
greenshift plugin to 13.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Greenshift WordPress plugin. It occurs because the plugin does not properly escape a block animation attribute before using it in an HTML attribute. This allows users with contributor-level access or higher to inject malicious scripts that execute when the content is viewed.

Detection Guidance

Check the installed version of the Greenshift WordPress plugin. If it is below 13.2.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker with contributor access or higher could inject malicious scripts into your WordPress site. These scripts could steal user data, perform actions on behalf of users, or deface your website. Visitors to your site could be exposed to these risks when viewing the affected content.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR if personal data is exposed. For HIPAA, it could compromise protected health information if the site handles such data. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Update the Greenshift plugin to version 13.2.0 or later immediately. Remove or disable the plugin if updating is not possible. Review user roles with contributor-level access or higher for any suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart