CVE-2026-5092

Name of the Vulnerable Software and Affected Versions Greenshift versions prior to 12.9.0

Description The Greenshift – animation and page builder blocks plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the customapi action handler does not sufficiently sanitize API responses before they are output using innerHTML. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 12.8.9.