{"id":"CVE-2026-83544","title":"The Greenshift  WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts tha…","summary":"The Greenshift  WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts tha…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-79"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83544","references":[{"url":"https://wpscan.com/vulnerability/f2bd202b-43fc-4ca7-9bab-649ed87e7cbd/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00235,"epssPercentile":0.14801,"ingestedAt":"2026-09-06T05:50:39.432Z","slug":"CVE-2026-83544","body":"## Overview\n\nThe Greenshift  WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8274,"id":"CVE-2026-83544","ts":1788919995292,"field":"cvss","old":null,"new":"6.8"},{"seq":8273,"id":"CVE-2026-83544","ts":1788919995292,"field":"severity","old":"none","new":"medium"},{"seq":8083,"id":"CVE-2026-83544","ts":1788919281117,"field":"cvss","old":"6.8","new":null},{"seq":8082,"id":"CVE-2026-83544","ts":1788919281117,"field":"severity","old":"medium","new":"none"},{"seq":7892,"id":"CVE-2026-83544","ts":1788916356391,"field":"cvss","old":null,"new":"6.8"},{"seq":7891,"id":"CVE-2026-83544","ts":1788916356391,"field":"severity","old":"none","new":"medium"},{"seq":7701,"id":"CVE-2026-83544","ts":1788915297817,"field":"cvss","old":"6.8","new":null},{"seq":7700,"id":"CVE-2026-83544","ts":1788915297817,"field":"severity","old":"medium","new":"none"},{"seq":7510,"id":"CVE-2026-83544","ts":1788912717015,"field":"cvss","old":null,"new":"6.8"},{"seq":7509,"id":"CVE-2026-83544","ts":1788912717015,"field":"severity","old":"none","new":"medium"},{"seq":7319,"id":"CVE-2026-83544","ts":1788911331765,"field":"cvss","old":"6.8","new":null},{"seq":7318,"id":"CVE-2026-83544","ts":1788911331765,"field":"severity","old":"medium","new":"none"},{"seq":7123,"id":"CVE-2026-83544","ts":1788909078653,"field":"cvss","old":null,"new":"6.8"},{"seq":7122,"id":"CVE-2026-83544","ts":1788909078653,"field":"severity","old":"none","new":"medium"},{"seq":6935,"id":"CVE-2026-83544","ts":1788907391844,"field":"cvss","old":"6.8","new":null},{"seq":6934,"id":"CVE-2026-83544","ts":1788907391844,"field":"severity","old":"medium","new":"none"},{"seq":6737,"id":"CVE-2026-83544","ts":1788905444590,"field":"cvss","old":null,"new":"6.8"},{"seq":6736,"id":"CVE-2026-83544","ts":1788905444590,"field":"severity","old":"none","new":"medium"},{"seq":6555,"id":"CVE-2026-83544","ts":1788903460057,"field":"cvss","old":"6.8","new":null},{"seq":6554,"id":"CVE-2026-83544","ts":1788903460057,"field":"severity","old":"medium","new":"none"},{"seq":6341,"id":"CVE-2026-83544","ts":1788901810908,"field":"cvss","old":null,"new":"6.8"},{"seq":6340,"id":"CVE-2026-83544","ts":1788901810908,"field":"severity","old":"none","new":"medium"},{"seq":6171,"id":"CVE-2026-83544","ts":1788899562448,"field":"cvss","old":"6.8","new":null},{"seq":6170,"id":"CVE-2026-83544","ts":1788899562448,"field":"severity","old":"medium","new":"none"},{"seq":6039,"id":"CVE-2026-83544","ts":1788898240517,"field":"cvss","old":null,"new":"6.8"},{"seq":6038,"id":"CVE-2026-83544","ts":1788898240517,"field":"severity","old":"none","new":"medium"}]}