Wpsoul

1 linked audits · 0 IOCs catalogued · 70k+ headline-plugin installs · first seen 2026-05-04 · last activity 2026-05-04

Audits in this campaign

Benign

Audit #29 Greenshift – animation and page builder blocks — 70k+ installs

Verdict: benign — wp.org guideline violation, not malware. Greenshift was closed by wp.org twice in four months (2026-01-15 and 2026-04-29) over the same root cause: the free plugin shipped a full paid-license activation system + hardcoded…

baseline 12.5.7 → head 12.9.5 1mo ago