CVE-2026-107627 in Greenshift Plugin
Summary
by MITRE • 10/29/2026
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Greenshift animation and page builder plugin for WordPress contains a critical security vulnerability classified as Stored DOM-Based Cross-Site Scripting within versions up to 13.2.1. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing user-supplied data, specifically targeting the comment parameter in various block configurations. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that are subsequently rendered by legitimate users. Unlike reflected XSS where malicious payloads are executed immediately upon request, stored variants persist on the server or within the page structure, ensuring that every visitor who loads the compromised content triggers the execution of the injected script in their browser environment.
The technical mechanism behind this exploitation relies on specific configuration conditions within the Greenshift plugin architecture. For an attack to succeed, an administrator must have published a page containing a Text Animated block with its Content setting configured to Blocks. Nested inside this structure is a Latest Comments block that has excerpts enabled. Additionally, at least one Animated Texts value must be configured in the settings. These conditions trigger the loading of the gs-textanimate JavaScript file on the frontend. When the page renders, this script processes comment excerpts without adequately validating or escaping special characters such as quotes and angle brackets. Consequently, if an attacker posts a comment containing malicious JavaScript code within any public discussion thread associated with that post, the excerpt display logic will inject this payload directly into the DOM structure of the animated text block.
From an operational impact perspective, this vulnerability poses significant risks to website integrity and user safety. Since the script executes in the context of the victim's browser session on the target domain, attackers can perform a wide range of malicious activities including stealing administrative cookies or authentication tokens, hijacking user sessions, defacing the website content by modifying DOM elements, redirecting users to phishing sites, or installing keyloggers and malware. The fact that exploitation requires an administrator to have previously configured specific blocks means the attack surface is somewhat constrained but still highly dangerous because it leverages trusted administrative actions to establish a persistent backdoor-like presence in publicly accessible pages.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the Stored XSS subcategory where malicious scripts are permanently stored within target servers. In terms of MITRE ATT&CK framework mapping, this behavior corresponds to T1059 Command and Control via Application Layer Protocol or more accurately T1189 Drive-by Client Side Web Traffic if considering initial access vectors leading to compromise, though primarily it represents a client-side code injection technique often utilized in subsequent phases like Credential Access through browser session hijacking.
Mitigation strategies should focus on immediate remediation of the input validation and output encoding processes within the affected plugin components. Developers must implement strict allow-listing for permitted HTML tags and attributes when rendering comment excerpts, ensuring that script execution capabilities are neutralized unless explicitly required by safe contexts which is rarely applicable in this scenario. Furthermore, implementing Content Security Policy headers can provide an additional layer of defense by restricting sources from which scripts may be loaded or executed. Administrators using affected versions should update to the latest patched version immediately upon release and review existing pages for any potential compromise indicators such as unexpected script tags or unusual DOM structures introduced via comment sections. Regular security audits and penetration testing focusing on input handling in dynamic content rendering engines are recommended to prevent similar vulnerabilities from persisting in future releases of page builder plugins that handle user-generated content dynamically.