8.8
Élevée
CVE-2025-3616 The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to…
Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Greenshift – animation and page builder blocks 11.4 | 11.4 → 11.4.5 | Pas de correctif indiqué |
Autres CVE de Greenshift – animation and page builder blocks
Les 20 CVE de Greenshift – animation and page builder blocks →
CVE-2026-107627
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…
5.4
Moyenne
CVE-2026-107629
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…
5.4
Moyenne
CVE-2026-93880
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site…
6.1
Moyenne
CVE-2026-5092
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
6.4
Moyenne