WordPress plugin
Greenshift – animation and page builder blocks security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium28
- Low0
All Greenshift – animation and page builder blocks vulnerabilities
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix
≤13.2.2Update to 13.2.3
- Medium5.3Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter
≤13.2.2Update to 13.2.3
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
≤13.2.1Update to 13.2.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
≤13.2.1Update to 13.2.2
- Medium6.1Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
≤13.2.0Update to 13.2.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
<13.2.0Update to 13.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<13.2.0Update to 13.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
≤12.8.9Update to 12.9.0
- Medium4.3Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
≤12.8.9Update to 12.9.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute
≤12.8.9Update to 12.9.0
- Medium5.3Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'
≤12.8.3Update to 12.8.4
- Medium5.3Unauthenticated Sensitive Information Exposure via Settings Backup
≤12.8.3Update to 12.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤12.8.5Update to 12.8.6
- Medium5.4Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css
≤12.6Update to 12.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes
≤12.2.7Update to 12.2.8
- Medium4.3Missing Authorization
≤12.1.1Update to 12.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.5.5Update to 11.5.7
- High8.811.4.5 - Authenticated (Subscriber+) Arbitrary File Upload
11.4 – 11.4.5Update to 11.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.0.2Update to 11.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤10.8Update to 10.9
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting
≤9.0.0Update to 9.0.1
- Medium4.3Authenticated (Contributor+) Post Disclosure
≤9.9.9.3Update to 9.9.9.4
- Medium5.3Missing Authorization
≤9.7Update to 9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.3.7Update to 9.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.9.3Update to 8.9.4
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤7.6.2Update to 7.6.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤4.9.9Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.9.9Update to 5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.8.8Update to 4.8.9
- Medium6.3Missing Authorization Checks
all versionsNo patch available
Greenshift – animation and page builder blocks: common questions
Does Greenshift – animation and page builder blocks have known vulnerabilities?
Yes. VulnCrest Radar lists 30 known vulnerabilities in Greenshift – animation and page builder blocks: 2 high, 28 medium. At least one is not fixed in the latest version.
How do I check which version of Greenshift – animation and page builder blocks I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Greenshift – animation and page builder blocks vulnerability?
CVE-2026-119218, published Nov 6, 2026: Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix. Severity: Medium (CVSS 5.4).
Is any Greenshift – animation and page builder blocks vulnerability listed in CISA KEV?
No. None of the known Greenshift – animation and page builder blocks vulnerabilities is currently listed in the CISA KEV catalog.