4.1
Medium
CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side,…
Description
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Greenshift 13.2 | earliest → < 13.2.0 | 13.2.0 |
Other CVEs of Greenshift
The 4 CVEs of Greenshift →
CVE-2026-83544
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it…
6.8
Medium
CVE-2023-0378
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them…
6.8
Medium
CVE-2022-4653
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could…
5.4
Medium