CVE-2026-119218

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks versions prior to 13.2.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the url (comment author url) parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. Exploitation requires the page to be configured with a GreenShift Interaction Layer attach-attribute action that copies a comment-author anchor's href into a Counter block's data-prefix or data-postfix attribute. Once the comment is published, the payload executes for every visitor who loads the Counter into the viewport.

Recommendations Update Greenshift – animation and page builder blocks to version 13.2.3 or later.