CVE-2025-11841

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11841", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-16T08:44:43.701Z", "datePublished": "2025-11-04T01:50:26.195Z", "dateUpdated": "2026-04-08T17:31:45.064Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:45.064Z"}, "affected": [{"vendor": "wpsoul", "product": "Greenshift \u2013 animation and page builder blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "12.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Greenshift \u2013 animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2455fb-69b9-4dbc-9c59-fd2cdd5b4d0f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3386004/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-10-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-21T18:59:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-03T13:41:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T20:48:50.223296Z", "id": "CVE-2025-11841", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:49:06.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11841", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:48:50.223296Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:49:00.756Z"}}], "cna": {"title": "Greenshift \u2013 animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpsoul", "product": "Greenshift \u2013 animation and page builder blocks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-21T18:59:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-03T13:41:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2455fb-69b9-4dbc-9c59-fd2cdd5b4d0f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3386004/"}], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:45.064Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11841", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:45.064Z", "dateReserved": "2025-10-16T08:44:43.701Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T01:50:26.195Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Greenshift \u2013 animation and page builder blocks", "vendor": "wpsoul", "versions": [{"lessThanOrEqual": "12.2.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Greenshift - animation and page builder blocks para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los atributos Chart Data en todas las versiones hasta la 12.2.7, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11841", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11841", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T20:48:50.223296Z", "version": "2.0.3"}}]}, "published": "2025-11-04T03:15:49.467", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3386004/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2455fb-69b9-4dbc-9c59-fd2cdd5b4d0f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:42:02.938630+00:00", "value": {"mitigation_remediation": ["Update the Greenshift \u2013 animation and page builder blocks plugin to the newest available release that removes the vulnerable chart data handling.", "Temporarily remove or disable chart blocks from any affected pages to prevent execution until the plugin is updated.", "Re\u2011evaluate the Contributor role permissions to limit the ability to add chart blocks with unsanitized data, and consider disabling the chart feature via the plugin\u2019s settings until the fix is deployed."], "summary": {"action": "Patch Plugin", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "WordPress plugin Greenshift \u2013 animation and page builder blocks, all releases up to and including version 12.2.7.", "description_and_impact": "The Greenshift \u2013 animation and page builder blocks plugin contains a Stored XSS flaw caused by the Chart Data attributes that fail to sanitize input or escape output. Authenticated users with Contributor privileges or higher can submit arbitrary scripts through these attributes, which are then persisted and served on any page containing the chart. When an unsuspecting user views the affected page, the embedded script executes in that user\u2019s browser, potentially allowing injection of malicious code, theft of credentials, defacement, or other forms of user\u2011targeted exploitation.", "risk_and_exploitability": "The vulnerability received a CVSS score of 6.4, placing it in the medium severity range. An EPSS score of less than 1% indicates a very low public exploit probability at the time of this analysis, and the flaw is not listed in the CISA KEV catalog. Likely attack vectors involve an authenticated attacker logging into the WordPress administration area, creating or editing a page or post that uses the chart block, and inserting malicious JavaScript into the chart data fields. The stored script would then trigger when any visitor loads the page, providing the attacker with persistent, cross\u2011site execution capabilities."}}}}, "created": "2025-11-04T16:33:31.311950+00:00", "updated": "2026-04-21T18:45:06.083609+00:00", "vendors": ["greenshiftwp", "greenshiftwp$PRODUCT$greenshift_-_animation_and_page_builder_blocks", "wordpress", "wordpress$PRODUCT$wordpress"]}