CVE-2026-107629

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks versions prior to 13.2.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the comment parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation requires a specific configuration where an Advanced HTML Element block with Split Text animation enabled wraps a Latest Comments block that displays comment excerpts, causing the splittext.js file to process the comment content container.

Recommendations Update to version 13.2.2 or later.