Stored DOM-Based Cross-Site Scripting in Greenshift Animation Plugin for WordPress

CVE-2026-107627

What is CVE-2026-107627?

The Greenshift animation and page builder blocks plugin for WordPress is susceptible to a Stored DOM-Based Cross-Site Scripting vulnerability. This occurs via the 'comment' parameter due to inadequate input sanitization and output escaping across all versions up to and including 13.2.1. Unauthenticated attackers can exploit this weakness by injecting arbitrary scripts in pages, which are executed whenever a user visits an affected page. Successful exploitation necessitates that an administrator has published a page containing specific elements, including a Text Animated block set to 'Blocks' and a Latest Comments block with excerpts enabled, that together facilitate the execution of the gs-textanimate script.

References