CVE-2026-93880 is a reflected cross-site scripting vulnerability in the Greenshift – animation and page builder blocks WordPress plugin. It affects all versions up to and including 13.2.0. The flaw occurs because the plugin does not properly sanitize or escape input substituted via the '{{GET:}}' dynamic placeholder in the Custom JS field of element blocks. When the Custom JS contains the token 'import', the substituted value is output unescaped inside a <script type="module"> tag, enabling injection of arbitrary web scripts by unauthenticated attackers who can trick users into clicking malicious links.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of the vulnerable website for users who interact with crafted links. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid using the '{{GET:}}' dynamic placeholder in the Custom JS field, especially with the 'import' token. Restrict or review Custom JS usage in element blocks to prevent injection of untrusted input. Implement web application firewall rules to detect and block suspicious requests if possible.