CVE-2026-107629: Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Exposure requires a page or post that uses an Advanced HTML Element block with Split Text animation enabled around a Latest Comments block configured to display comment excerpts. The affected Greenshift versions are 13.2.1 and earlier.
Does an attacker need a WordPress account or other privileges?
No. The vulnerability can be exploited by an unauthenticated attacker through the comment parameter, provided an affected page configuration processes the submitted comment content.
When does injected script execute?
The injected script executes when a user accesses the affected page containing the vulnerable block configuration. The issue is stored DOM-based XSS, so the malicious content can persist in the displayed comment content.