CVE-2026-107627

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks plugin for WordPress versions prior to 13.2.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the comment parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation requires a specific configuration where an administrator has published a page containing a Text Animated block with Content set to Blocks, a nested Latest Comments block with excerpts enabled, and at least one Animated Texts value configured, which triggers the gs-textanimate script to process the comment excerpts.

Recommendations Update the plugin to version 13.2.2 or later.