{
 "id": "WPSEC-2026-2614",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2614/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2614/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2614/index.md",
 "title": "Greenshift <= 13.2.2 - Unauthenticated DOM-Based Cross-Site Scripting via Interaction Layer Placeholders",
 "description": "The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via Interaction Layer placeholders in all versions up to, and including, 13.2.2, due to {{VALUE}}, {{ATTR:...}}, {{STORAGE:...}} and {{COOKIE:...}} values being written unescaped into innerHTML by the Set HTML content action, and into event handler, srcdoc or javascript: URL attributes by the Attach attribute action. On sites with an Interaction Layer that reads such data, this makes it possible for unauthenticated attackers who can control the data (for example an attribute of a comment they submit) to inject arbitrary web scripts that execute when a visitor triggers the interaction.",
 "plugin": {
  "slug": "greenshift-animation-and-page-builder-blocks",
  "name": "Greenshift",
  "full_name": "Greenshift – animation and page builder blocks",
  "wordpress_org": "https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/greenshift-animation-and-page-builder-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "13.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 13.2.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "13.2.3",
 "remediation": "Update to 13.2.3 or later.",
 "fix_released": "2026-11-04T18:41:09+00:00",
 "published": "2026-11-05T18:43:11+00:00",
 "updated": "2026-11-05T09:51:24.083678+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2614/",
  "https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.3/",
  "https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}