{
 "id": "WPSEC-2026-1284",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1284/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1284/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1284/index.md",
 "title": "Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Split Text Animations",
 "description": "The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Split Text animations (data-aos-split and gs-split-words) in all versions up to, and including, 13.2.1. This is due to the split-text script reading element text with innerText, which decodes HTML entities, and putting each word back into the page with innerHTML without escaping it. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user visits the affected page. The unauthenticated route needs entity-encoded markup in approved content, such as a comment, that is shown inside an element using split-text animation. Contributors and above can exploit the flaw directly through text they write into such elements.",
 "plugin": {
  "slug": "greenshift-animation-and-page-builder-blocks",
  "name": "Greenshift",
  "full_name": "Greenshift – animation and page builder blocks",
  "wordpress_org": "https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/greenshift-animation-and-page-builder-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "13.2.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 13.2.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "13.2.2",
 "remediation": "Update to 13.2.2 or later.",
 "fix_released": "2026-10-20T00:31:30+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:16.650864+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1284/",
  "https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.2/",
  "https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}