8.8
High
CVE-2025-3616 The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to…
Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Greenshift – animation and page builder blocks 11.4 | 11.4 → 11.4.5 | No fix stated |
Other CVEs of Greenshift – animation and page builder blocks
The 20 CVEs of Greenshift – animation and page builder blocks →
CVE-2026-107627
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…
5.4
Medium
CVE-2026-107629
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…
5.4
Medium
CVE-2026-93880
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site…
6.1
Medium
CVE-2026-5092
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
6.4
Medium