CVE-2026-83544: CWE-79 Cross-Site Scripting (XSS) in Greenshift

The Greenshift WordPress plugin versions prior to 13.2.0 contain a CWE-79 Cross-Site Scripting vulnerability due to improper escaping of a block animation attribute in HTML output. This allows authenticated users with contributor-level privileges or above to inject malicious scripts that execute in the context of other users viewing the affected content. The vulnerability is network exploitable with low attack complexity but requires user interaction and privileges. No official patch or remediation guidance is currently provided in the available data.

Successful exploitation could lead to arbitrary script execution in the browsers of users viewing the affected content, potentially resulting in credential theft, session hijacking, or other malicious actions performed with the victim's privileges. The vulnerability requires contributor-level access or higher, limiting exploitation to authenticated users with elevated permissions. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting the use of the vulnerable block animation feature to reduce risk.