https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 04:24:41 +0000 https://db.gcve.eu/vuln/cve-2026-120520 <p><strong>Affected:</strong> wpsoul Greenshift – animation and page builder blocks</p> <p>The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the &#39;img (or any key the publisher references in {{GET:key}})&#39; parameter. This makes it possible for unauthenticated attackers to extract authenticated users&#39; HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim&#39;s browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker&#39;s crafted link — neither condition is part of the plugin&#39;s default state.</p> <p><strong>Affected:</strong> wpsoul Greenshift – animation and page builder blocks</p> <p>The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the &#39;img (or any key the publisher references in {{GET:key}})&#39; parameter. This makes it possible for unauthenticated attackers to extract authenticated users&#39; HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim&#39;s browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker&#39;s crafted link — neither condition is part of the plugin&#39;s default state.</p> https://db.gcve.eu/vuln/cve-2026-120520