{
 "id": "WPSEC-2026-1283",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1283/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1283/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1283/index.md",
 "title": "Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Text Animated Element",
 "description": "The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the Text Animated element in all versions up to, and including, 13.2.1. This is due to the element's front-end script reading the element's text with textContent, which decodes HTML entities, and writing it back into the page with innerHTML, which turns escaped markup back into live HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user visits the affected page. The unauthenticated route needs entity-encoded markup in approved content, such as a comment, that is shown inside a Text Animated element. Contributors and above can exploit the flaw directly through text they place in the element.",
 "plugin": {
  "slug": "greenshift-animation-and-page-builder-blocks",
  "name": "Greenshift",
  "full_name": "Greenshift – animation and page builder blocks",
  "wordpress_org": "https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/greenshift-animation-and-page-builder-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "13.2.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 13.2.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "13.2.2",
 "remediation": "Update to 13.2.2 or later.",
 "fix_released": "2026-10-20T00:31:30+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:16.650864+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1283/",
  "https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.2/",
  "https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}