Greenshift | Page Builder and Animation Gutenberg Plugin Changelog

Undated · 14 versions

1. 13.2.3

   Latest

   1 improvement14 fixes

   Hide

   Improved

   • AI model lists in settings - added GPT-6 Astra, GPT-6.1 Sol, GPT-6.1 Terra, GPT-6 Luna, Claude Opus 5.5, Claude Fable 5.1, Claude Sonnet 5.5, Claude Haiku 5.5, Gemini 3.8 Flash, Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, Nano Banana 2.1, GPT Image 2.5 Sunburst and Flare. Removed Gemini models that Google has shut down; the default image model is now the stable Gemini 3 Pro Image

   Fixed

   • Synced patterns printed their style tag twice, and blocks without CSS printed an empty - since WordPress 6.9 a synced pattern runs the block render filter twice. Each style is printed once now and empty tags are skipped
   • Element repeater inside another repeater crashed in the editor (slice(...).map is not a function) when the nested field was a JSON string or plain text, for example raw query data or ACPT fields. JSON strings are decoded the same way as on the frontend
   • Query and repeater post type selectors did not list public post types registered with publicly_queryable set to false
   • WPML registered Icon List item texts several times in the Advanced Translation Editor. Only the item text is extracted now
   • Dynamic panel (mobile menu) stayed open after tapping a link to a section on the same page
   • Stored DOM XSS through the Counter block - a value copied onto the Counter prefix by an Interaction Layer with {{ATTR:...}} (for example a comment author URL) ran as HTML for every visitor. Counter prefix and postfix are now set as text only, so HTML typed in these fields shows as plain text
   • same issue in the Set HTML content interaction - {{ATTR:...}}, {{VALUE}}, {{STORAGE:...}} and {{COOKIE:...}} values are now inserted as text. Markup typed in the action and {{CONTENT}} stay HTML
   • same issue in the Typewriter text animation - the text is now set as text only
   • Attach attribute interaction no longer writes a value built from page or visitor data into event handlers (on*), srcdoc or javascript: links
   • Sensitive data exposure through nested placeholders - a crafted link could place {{COOKIE:...}} inside a {{GET:...}} value and put a logged in visitor's login cookie into an image URL. Values from GET, COOKIE and FORM placeholders can no longer contain placeholders, the same applies to values read by Interaction Layers, and {{COOKIE:...}} never prints WordPress login, session or post password cookies, WooCommerce session cookies or PHPSESSID
   • Portrait Mobile styles were not visible in the block editor when the mobile breakpoint is smaller than the core Mobile preview (360px before WordPress 7.1, 479px since). Selecting Portrait Mobile in the device switcher now narrows the canvas to the portrait width; core's own width is kept when it already fits the portrait breakpoint
   • Marquee on RTL sites showed an empty gap between loops. The copies are now laid out left to right while their content keeps the RTL direction, existing marquees are fixed without resaving
   • Charts with dynamic CSV / Google Sheet loading received a rest_forbidden error instead of data for visitors (and cached it), because the CSV route requires the edit_posts capability. The CSV converter now runs in the same request
   • Text selection shortcuts (Shift+Arrow, Ctrl/Alt+Shift+Arrow) selected whole blocks instead of text in Element, Text, Heading, Button, Accordion, Tabs, Icon List, Progress Bar, Switcher and Title Box text fields. The block editor treated these fields as non-text because they had no selection identifier

2. 13.2.2

   4 fixes

   Hide

   Fixed

   • Stored DOM XSS in the Text Animated element - its first text was read as plain text and then written back as HTML, so a comment like <svg/onload=...> shown by a nested Latest Comments block (Content set to Blocks) became live markup for every visitor. The text is now set as text only
   • same issue in Split Text animations (data-aos-split, gs-split-words) - each word is now HTML escaped before the lines and words are rebuilt
   • dynamic values that come back as numbers (for example ACF image IDs) no longer break Element text, image and video placeholders in the editor
   • switching the editor preview from landscape mobile to portrait mobile now restores the core canvas width instead of keeping the landscape width

3. 13.2.1

   2 improvements2 fixes

   Hide

   Improved

   • wrap {{GET:...}} and {{COOKIE:...}} placeholders in quotes when you use them in Custom JS. Unquoted, only letters and digits are passed through, and any other character now stops the script with a syntax error instead of running as code
   • headingContent, textContent and buttonContent were removed from wpml-config.xml for the Heading, Advanced text and Button blocks - their text is translated from the block markup

   Fixed

   • Reflected XSS through the {{GET:...}} and {{COOKIE:...}} dynamic placeholders - URL and cookie values are now JavaScript escaped when they are placed into element Custom JS (including Custom JS controllers) and HTML escaped everywhere else, so a crafted link can no longer break out of a script string or an HTML attribute and run code in the visitor's browser
   • inspector input border styles are now limited to GreenShift panels, so input controls of the core editor and other plugins keep their own borders in light and dark mode

4. 13.2.0

   1 new3 fixes

   Show

   New

   • gspb_allowed_csv_hosts filter, for site owners who host their CSV data on another trusted host

   Fixed

   • Stored XSS in GSAP animation data attributes - the customProps, customPropsM and multianimations values are now HTML escaped before they are written into the block markup, so a value saved by a lower privileged user (Contributor and up) can no longer break out of the attribute and inject an event handler. Reported by Revanth Hari Narayana Matte
   • Server Side Request Forgery in the CSV to JSON REST endpoint - CSV imports are now limited to Google Sheets hosts (docs.google.com, spreadsheets.google.com) over https instead of fetching any URL the request asks for. Reported by Alireza Kalhor
   • chart CSV link is now URL encoded when it is passed to the CSV endpoint, so published Google Sheets links with several query parameters are no longer truncated

5. 13.1.9

   1 improvement1 fix

   Show

   Improved

   • breakpoints now injected from theme.json if they are existed

   Fixed

   • global class was removed from block classes, but stayed in block attributes, when it was deleted in class selector right after selecting it (synchronization request with database restored deleted class)

6. 13.1.8

   2 improvements

   Show

   Improved

   • theme.json custom breakpoints (settings.viewport, WordPress 7.1+) are now applied automatically to frontend styles - no option needed; the "Overwrite breakpoints by theme.json" checkbox was removed and the Breakpoints settings show the detected theme values instead
   • breakpoints are resolved once per request (theme.json lookup and settings are cached), so the automatic check adds no measurable overhead to style rendering

7. 13.1.7

   2 new

   Show

   New

   • Support for custom responsive breakpoints from theme.json (settings.viewport, WordPress 7.1+) - editor preview styles and device preview widths now follow the theme breakpoints automatically, matching the core responsive engine and themes like Blocksy
   • "Overwrite breakpoints by theme.json" option in Breakpoints settings - applies the theme.json breakpoints to frontend styles instead of the manual Tablet and Desktop values

8. 13.1.6

   1 fix

   Show

   Fixed

   • Responsive device styles and toolbar synchronization now work correctly in the WordPress 7.1 editor, with fallback support for WordPress 7.0 and older editor APIs

9. 13.1.5

   1 new1 improvement1 fix

   Show

   New

   • text-stroke support in server side style rendering

   Improved

   • better API keys handling, few UI updates

   Fixed

   • Server side rendering and preparation for full on fly css rendering which is better for agents (disabling plugin do not break frontend).

10. 13.1.4

    3 new

    Show

    New

    • AI Agent Prompt builder in Settings - AI & API Keys - ready-to-copy prompts for AI agents (Claude Code, Cursor, Codex) with prompt types for building designs, fixing blocks, charts, tables and conversions, powered by the greenlight-vibe skill
    • No AI Slop option for agent prompts - adds strict design rules that prevent the generic AI look (violet gradient glows, pulsing dots, glassmorphism and more)
    • Site connection option for agent prompts - generate and manage application passwords directly in settings, prompt includes REST API credentials so agents can publish content to the site

11. 13.1.3

    2 new

    Show

    New

    • Rank Math Table of Contents block support - headings from Heading Advanced and Element blocks now appear in the TOC block with working anchor links
    • OpenGraph image option in Settings - Theme settings - uses the Featured Image on singular pages with a configurable fallback image

12. 13.1.2

    2 new1 improvement4 fixes

    Show

    New

    • Rank Math SEO integration - headings from GreenShift blocks are now visible to Rank Math content analysis (keyword in subheadings, Table of Contents and content length checks)
    • WPML support for links inside Element blocks - link text and href are now translatable

    Improved

    • AI model list in settings (claude-opus-4-8, claude-sonnet-5)

    Fixed

    • Accordion scroll to open item landed on wrong position when auto-close mode is enabled - now it waits for the previous item to collapse before scrolling
    • StyleBook element crash when rendering the Subselector panel
    • Modal close button class renamed to avoid CSS conflicts with theme styles
    • Custom block icon colors are no longer overridden in the list view for selected blocks

13. 13.1.0

    3 new

    Show

    New

    • Improved class saving
    • Option quick live search for classes and local style panel
    • Updated AI skills for improved export to WordPress options outside wordpress environment

14. 13.0.0

    2 new1 improvement

    Show

    New

    • GLAI 2.0, our inner AI helper, now more stable and with support of dynamic template generations + updated model list in settings
    • "Disable button preset panel" option in Settings - Interface to hide the Button Presets panel in Button and Link element blocks

    Improved

    • Updated Vimeo Player SDK to v2.30.4 to resolve deprecated API warnings in the video player