Stored DOM-Based Cross-Site Scripting in Greenshift Animation and Page Builder Blocks Plugin

CVE-2026-107629

What is CVE-2026-107629?

The Greenshift Animation and Page Builder Blocks plugin for WordPress has a vulnerability that allows for Stored DOM-Based Cross-Site Scripting. This issue arises from insufficient input sanitization and output escaping through the 'comment' parameter in all releases up to and including version 13.2.1. Attackers can exploit this vulnerability by injecting malicious scripts into a page, leading to unauthorized actions being performed when users visit the compromised page. Specifically, exploitation requires the page to utilize an Advanced HTML Element block with Split Text animation that wraps a Latest Comments block, enabling the processing of comment content via splittext.js. This vulnerability highlights the need for robust input validation and sanitization practices in plugin development.

References