Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Text Animated Element

ID

WPSEC-2026-1283

Plugin

Greenshift – animation and page builder blocks (greenshift-animation-and-page-builder-blocks)

Affected

all versions before 13.2.2

Remediation

Update to 13.2.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21

Attack surface

Greenshift on WPSec AttackSurface

Fix released

2026-10-20

Published

2026-10-21

Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the Text Animated element in all versions up to, and including, 13.2.1. This is due to the element's front-end script reading the element's text with textContent, which decodes HTML entities, and writing it back into the page with innerHTML, which turns escaped markup back into live HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user visits the affected page. The unauthenticated route needs entity-encoded markup in approved content, such as a comment, that is shown inside a Text Animated element. Contributors and above can exploit the flaw directly through text they place in the element.

References

• https://wpsec.com/vuln/WPSEC-2026-1283/
• https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.2/
• https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS