CVE-2026-93880: Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to this issue?
Exposure requires an administrator to have configured an Element block's Custom JS field with a {{GET:...}} dynamic placeholder and to include the token "import" in that JavaScript. Sites without that specific configuration are not affected by the described exploit path.
What does an attacker need to exploit it?
An attacker does not need authentication, but must cause a user to perform an action such as clicking a crafted link. The crafted request supplies a GET value that is inserted into the affected Custom JS output and can execute as script in the user's browser.
How can administrators check whether their site is vulnerable?
Review Element blocks for Custom JS fields that use a {{GET:...}} placeholder. Prioritize any matching field whose JavaScript also contains the token "import", as that combination uses the unescaped output path described in the vulnerability.
What can be done if updating is not immediately possible?
Remove {{GET:...}} placeholders from Element block Custom JS fields, or remove the "import" token from the relevant JavaScript so the described vulnerable branch is not reached. Treat any configuration that combines both as exposed until it is changed.