The GreenShift plugin for WordPress suffers from a stored XSS vulnerability due to insufficient sanitization in the gspb_greenShift_block_script_assets() function. This function attempts to insert 'fetchpriority="high"' before 'src=' attributes by using str_replace() on the entire HTML string without proper parsing. Because contributors can inject 'src=' strings into HTML attribute values, the replacement breaks out of attribute contexts, enabling injection of malicious HTML attributes such as onfocus with JavaScript payloads. This flaw allows authenticated users with contributor or higher privileges to embed persistent scripts that execute upon page access.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages built with the GreenShift plugin. These scripts execute in the context of users viewing the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the GreenShift plugin if possible. Monitor for updates from the vendor or plugin maintainers and apply official patches promptly once available.