The vulnerability in Greenshift allows an unauthenticated attacker to store malicious JavaScript in a comment field that is later executed in a victim’s browser when a page containing a Text Animated block and a nested Latest Comments block with excerpts is accessed. The flaw arises from insufficient input sanitization and output escaping, giving an attacker the ability to inject and run arbitrary scripts that compromise the confidentiality, integrity, or availability of the site for any user who views those pages.

Adversaries must target the WordPress plugin Greenshift – animation and page builder blocks, version 13.2.1 or earlier. The affected product is a WordPress block plugin from the vendor wpsoul. The issue exists in all releases up to and including 13.2.1; later versions may have been fixed.

The CVSS score of 5.4 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this unauthenticated flaw once an administrator has published a page that uses a Text Animated block with Blocks set to Content, nests a Latest Comments block with excerpts enabled, and configures at least one Animated Text value. Because these conditions require a pre‑existing published page, the likelihood of exploitation is limited to sites that have such a configuration in place.