# Greenshift <= 13.2.1 - Unauthenticated Stored Cross-Site Scripting via Split Text Animations

- **ID:** WPSEC-2026-1284
- **Plugin:** Greenshift – animation and page builder blocks (`greenshift-animation-and-page-builder-blocks`), https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/
- **Affected versions:** all versions before 13.2.2
- **Fixed in:** 13.2.2 (Update to 13.2.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1284/

## Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Split Text animations (data-aos-split and gs-split-words) in all versions up to, and including, 13.2.1. This is due to the split-text script reading element text with innerText, which decodes HTML entities, and putting each word back into the page with innerHTML without escaping it. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user visits the affected page. The unauthenticated route needs entity-encoded markup in approved content, such as a comment, that is shown inside an element using split-text animation. Contributors and above can exploit the flaw directly through text they write into such elements.

## References

- https://wpsec.com/vuln/WPSEC-2026-1284/
- https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.2/
- https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1284/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.