Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Split Text Animations

ID

WPSEC-2026-1284

Plugin

Greenshift – animation and page builder blocks (greenshift-animation-and-page-builder-blocks)

Affected

all versions before 13.2.2

Remediation

Update to 13.2.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21

Attack surface

Greenshift on WPSec AttackSurface

Fix released

2026-10-20

Published

2026-10-21

Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Split Text animations (data-aos-split and gs-split-words) in all versions up to, and including, 13.2.1. This is due to the split-text script reading element text with innerText, which decodes HTML entities, and putting each word back into the page with innerHTML without escaping it. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user visits the affected page. The unauthenticated route needs entity-encoded markup in approved content, such as a comment, that is shown inside an element using split-text animation. Contributors and above can exploit the flaw directly through text they write into such elements.

References

• https://wpsec.com/vuln/WPSEC-2026-1284/
• https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.2/
• https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS