CVE-2026-1927

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1927", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T19:48:41.429Z", "datePublished": "2026-02-05T13:27:37.702Z", "dateUpdated": "2026-04-08T16:59:37.374Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:37.374Z"}, "affected": [{"vendor": "wpsoul", "product": "Greenshift \u2013 animation and page builder blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "12.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including, 12.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve global plugin settings including stored AI API keys and modify plugin settings, including the injection of arbitrary web scripts via the 'custom_css' value (stored XSS). NOTE: This vulnerability was partially patched in version 12.6."}], "title": "GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2128db-ca9f-4211-8bc5-01a2cc1cba64?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441535/greenshift-animation-and-page-builder-blocks/trunk/init.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441609/greenshift-animation-and-page-builder-blocks"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ISMAILSHADOW"}], "timeline": [{"time": "2026-01-16T17:58:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-05T00:53:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:16:44.778258Z", "id": "CVE-2026-1927", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:17:29.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T14:16:44.778258Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:17:10.095Z"}}], "cna": {"title": "GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css", "credits": [{"lang": "en", "type": "finder", "value": "ISMAILSHADOW"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpsoul", "product": "Greenshift \u2013 animation and page builder blocks", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "12.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-16T17:58:07.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-05T00:53:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2128db-ca9f-4211-8bc5-01a2cc1cba64?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3441535/greenshift-animation-and-page-builder-blocks/trunk/init.php"}], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including, 12.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve global plugin settings including stored AI API keys and modify plugin settings, including the injection of arbitrary web scripts via the 'custom_css' value (stored XSS). NOTE: This vulnerability was partially patched in version 12.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-03T17:49:29.065Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1927", "state": "PUBLISHED", "dateUpdated": "2026-03-03T17:49:29.065Z", "dateReserved": "2026-02-04T19:48:41.429Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-05T13:27:37.702Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Greenshift \u2013 animation and page builder blocks", "vendor": "wpsoul", "versions": [{"lessThanOrEqual": "12.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including, 12.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve global plugin settings including stored AI API keys and modify plugin settings, including the injection of arbitrary web scripts via the 'custom_css' value (stored XSS). NOTE: This vulnerability was partially patched in version 12.6."}, {"lang": "es", "value": "El plugin Greenshift \u2013 bloques de animaci\u00f3n y constructor de p\u00e1ginas para WordPress es vulnerable a acceso no autorizado a datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n greenshift_app_pass_validation() en todas las versiones hasta la 12.5.7, ambas inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, recuperen configuraciones globales del plugin, incluyendo claves API de IA almacenadas."}], "id": "CVE-2026-1927", "lastModified": "2026-06-17T10:16:44.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1927", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:16:44.778258Z", "version": "2.0.3"}}]}, "published": "2026-02-05T14:16:04.693", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3441535/greenshift-animation-and-page-builder-blocks/trunk/init.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3441609/greenshift-animation-and-page-builder-blocks"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2128db-ca9f-4211-8bc5-01a2cc1cba64?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T18:48:57.541008+00:00", "value": {"mitigation_remediation": ["Update Greenshift to the latest version that includes the complete authorization check (version\u202f\u226512.7).", "If an update is not feasible, disable the custom_css option for non\u2011administrator roles or remove any custom CSS that may contain scripts.", "Enforce role capability checks by restricting Subscriber and lower roles from accessing plugin settings pages and remove the capability that currently grants access."], "summary": {"action": "Patch Immediately", "impact": "Information Disclosure and Stored XSS"}, "threat_synthesis": {"affected_systems": "Affected systems are WordPress installations running the Greenshift \u2013 animation and page builder blocks plugin from any version up to and including 12.6. The official remediation notes that a partial fix appears in 12.6, so any instance still running 12.5 or earlier remains fully vulnerable. Versions beyond 12.6 that include the complete patch are considered safe. Administrators should verify the installed plugin version and determine whether the latest available release contains the full fix.", "description_and_impact": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress has a missing capability check in the greenshift_app_pass_validation() function. This flaw allows any authenticated user with Subscriber privileges or higher to call the function and read or modify global plugin settings. The attacker can harvest stored AI API keys, an important credential that could be used to access external services, and inject arbitrary JavaScript through the custom_css field, leading to stored cross\u2011site scripting. The weakness is a missing authorization (CWE\u2011862) and results in both data disclosure and potential XSS attacks.", "risk_and_exploitability": "With a CVSS score of 5.4 and an EPSS score of less than\u202f1\u202f%, the vulnerability has medium severity and a very low estimated exploitation probability. It is not listed in the CISA KEV catalog, meaning no confirmed public exploits are in the CISA database yet. The attack vector requires a valid authenticated session and the subscriber role, so the opportunity to exploit depends on having such credentials. Once authenticated, the attacker can request plugin settings to extract AI keys or post crafted CSS that the plugin accepts, resulting in stored XSS that will execute whenever a page with the CSS is rendered."}}}}, "created": "2026-02-06T12:05:40.195369+00:00", "updated": "2026-04-15T19:00:12.275820+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpsoul", "wpsoul$PRODUCT$greenshift_\u2013_animation_and_page_builder_blocks"]}