CVE-2026-107627: Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Exposure requires a page with a Text Animated block configured with Content set to Blocks, containing a Latest Comments block with excerpts enabled, and at least one Animated Texts value. These conditions enqueue the gs-textanimate script and cause it to process comment excerpts.
What does an attacker need to exploit this issue?
The attacker does not need to authenticate. They need to submit a crafted comment that reaches an affected page configuration; an administrator must already have published the specific nested-block layout required to trigger processing of the comment excerpt.
Are all plugin installations affected in the same way?
No. The issue affects versions through 13.2.1, but exploitation depends on the specified page and block configuration. The provided information does not establish whether that configuration is present by default.
What can be changed while remediation is pending?
Avoid the triggering configuration on published pages: remove or alter the nested Latest Comments block, disable its excerpts, change the Text Animated block away from Content set to Blocks, or remove Animated Texts values. Any change that prevents the gs-textanimate script from processing comment excerpts removes the stated exploitation condition.
How can administrators identify potentially affected pages?
Confirm whether the plugin version is 13.2.1 or earlier, then review published pages for Text Animated blocks set to Content as Blocks that contain a Latest Comments block with excerpts enabled and configured Animated Texts values.