Security readout for executives and security teams
Plain-English summary
This affects WordPress sites using the Greenshift animation and page builder blocks plugin up to version 4.9.9. An authenticated author-level user could trigger cross-site scripting through SVG upload behavior. Business risk is moderate because access and user interaction are required, but successful XSS can affect site integrity and users.
Executive priority
Treat as a moderate-priority WordPress plugin issue. Address it in the normal vulnerability remediation cycle, faster for public-facing sites with many content contributors or less trusted author accounts.
Technical view
CVE-2023-22707 is a CWE-79 XSS issue in Wpsoul Greenshift – animation and page builder blocks <= 4.9.9. The CVSS 3.1 score is 5.9 with network attack vector, low complexity, high privileges, required user interaction, changed scope, and low confidentiality, integrity, and availability impacts.
Likely exposure
Exposure is limited to WordPress deployments running the Greenshift plugin at version 4.9.9 or earlier, especially where author-level accounts can upload or manage content. Sites without this plugin, or not on affected versions, are not indicated as affected by the provided sources.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is not described as unauthenticated; it requires an authenticated author-level or higher user and victim interaction, reducing broad internet-scale risk.
Researcher notes
Evidence supports authenticated XSS in Greenshift <= 4.9.9 with CVSS 5.9. Patch or fixed-version details are not present in the provided bundle, so remediation should be tied to vendor or Patchstack guidance rather than inferred.
Mitigation direction
- Inventory WordPress sites for the Greenshift plugin and installed version.
- Prioritize sites running Greenshift 4.9.9 or earlier.
- Check vendor, WordPress plugin, or Patchstack guidance for a fixed release.
- Restrict author-level access to trusted users until remediated.
- Review SVG upload and content publishing permissions for affected sites.
Validation and detection
- Confirm plugin presence and version in each WordPress environment.
- Verify whether author-level users can upload SVG or relevant content.
- Review site logs for suspicious author activity around content uploads.
- Check whether vendor guidance identifies a patched version.
- Document unaffected sites with no Greenshift installation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-22707 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L1.73.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.