CVE-2026-1927 describes a missing authorization (CWE-862) vulnerability in the Greenshift – animation and page builder blocks WordPress plugin. The issue arises from the lack of a capability check in the greenshift_app_pass_validation() function, allowing authenticated users with low privileges (Subscriber and above) to retrieve and modify sensitive plugin settings. This includes exposure of stored AI API keys and the ability to inject arbitrary web scripts through the 'custom_css' parameter, resulting in stored cross-site scripting (XSS). The vulnerability affects all versions up to and including 12.6, with a partial patch applied in version 12.6. No full patch or official fix link is provided.

An attacker with Subscriber-level access can access sensitive plugin configuration data, including AI API keys, and modify plugin settings. This can lead to stored XSS attacks via the 'custom_css' field, potentially compromising site integrity and user security. The vulnerability does not allow privilege escalation or denial of service but exposes confidential data and enables script injection. The partial patch in version 12.6 may reduce but not fully eliminate the risk.

Patch status is not yet confirmed as fully fixed since only a partial patch was applied in version 12.6 and no official fix advisory or patch link is provided. Users should verify with the plugin vendor for updates beyond version 12.6. Until a full fix is confirmed, restrict Subscriber-level access where possible and monitor for suspicious activity related to plugin settings. Avoid using versions up to 12.6 in sensitive environments.