# Greenshift <= 13.2.2 - Unauthenticated DOM-Based Cross-Site Scripting via Interaction Layer Placeholders

- **ID:** WPSEC-2026-2614
- **Plugin:** Greenshift – animation and page builder blocks (`greenshift-animation-and-page-builder-blocks`), https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/
- **Affected versions:** all versions before 13.2.3
- **Fixed in:** 13.2.3 (Update to 13.2.3 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/greenshift-animation-and-page-builder-blocks
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2614/

## Description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via Interaction Layer placeholders in all versions up to, and including, 13.2.2, due to {{VALUE}}, {{ATTR:...}}, {{STORAGE:...}} and {{COOKIE:...}} values being written unescaped into innerHTML by the Set HTML content action, and into event handler, srcdoc or javascript: URL attributes by the Attach attribute action. On sites with an Interaction Layer that reads such data, this makes it possible for unauthenticated attackers who can control the data (for example an attribute of a comment they submit) to inject arbitrary web scripts that execute when a visitor triggers the interaction.

## References

- https://wpsec.com/vuln/WPSEC-2026-2614/
- https://plugins.svn.wordpress.org/greenshift-animation-and-page-builder-blocks/tags/13.2.3/
- https://wordpress.org/plugins/greenshift-animation-and-page-builder-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2614/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.