CVE-2026-93880

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.

• CWE-79

• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.0/blockrender/element/block.php#L868
• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.0/includes/helper.php#L1381
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3714657%40greenshift-animation-and-page-builder-blocks&new=3714657%40greenshift-animation-and-page-builder-blocks
• https://www.wordfence.com/threat-intel/vulnerabilities/id/133a7a71-4428-4ada-8ed7-a7c6fe54a0cb?source=cve

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93870Cotonti through 1.0.0 fails to validate anti-CSRF tokens in …4.3
• CVE-2026-93871Cotonti through 1.0.0 fails to validate redirect destination…5.4
• CVE-2026-93872Cotonti 1.0.0 passes the base64-decoded cb parameter to unse…7.5
• CVE-2026-93873Cotonti through 1.0.0 fails to validate anti-CSRF tokens in …4.3
• CVE-2026-93875The JetAppointment plugin for WordPress is vulnerable to Sto…7.2
• CVE-2026-9388A weakness has been identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-93882The LearnPress – WordPress LMS Plugin for Create and Sell On…7.5
• CVE-2026-93884Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9389A security vulnerability has been detected in Tenda F456 1.0…8.8
• CVE-2026-93894In Vinyl Cache before 9.0,2, workspace buffer overflow vulne…2.3
• CVE-2026-93897The GeoDirectory – WP Business Directory Plugin and Classifi…6.4
• CVE-2026-93899The Better Messages – Chat Rooms, Group Chat, Private Messag…6.5