CVE-2026-4895

CVE-2026-4895 is a Stored Cross-Site Scripting vulnerability in the GreenShift - Animation and Page Builder Blocks plugin for WordPress, affecting versions up to 12.8.9. The flaw exists in the gspb_greenShift_block_script_assets() function, which improperly sanitizes input when processing image blocks with the disablelazy attribute. An authenticated attacker with contributor-level privileges can inject arbitrary HTML attributes containing malicious JavaScript into pages by exploiting the unsafe str_replace() operation. The vulnerability carries a CVSS score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and low privileges, though no user interaction is needed. The attack has limited scope and produces confidentiality and integrity impacts. While the EPSS score indicates this vulnerability ranks lower than most CVEs in prevalence, the exposure affects any WordPress site using the vulnerable plugin where contributor accounts exist. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and community attention appears minimal based on its inactive status on security tracking lists. However, organizations should prioritize patching given the low barrier to exploitation by internal contributors and the persistence of injected scripts affecting all site visitors.