CVE-2026-107629 in Greenshift Plugin
Summary
by MITRE • 10/29/2026
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Greenshift plugin for WordPress, specifically versions up through 13.2.1, contains a critical security flaw classified as Stored DOM-Based Cross-Site Scripting. This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the application code. The specific vector of exploitation is tied to the comment parameter associated with page building blocks. Because the data is stored on the server side before being rendered in the browser, it qualifies as a stored variant rather than a reflected one, meaning the malicious payload persists until the compromised content is manually removed or updated by an administrator.
The technical execution of this vulnerability relies heavily on specific configuration settings within the WordPress page structure. Exploitation requires that the affected post includes an Advanced HTML Element block where Split Text animation is enabled. This setting triggers the loading and initialization of splittext.js, a JavaScript library responsible for animating text characters individually. When combined with a Latest Comments block configured to display comment excerpts, the system processes the content container using this script. The flaw lies in how splittext.js handles the data it receives; it fails to properly sanitize or escape user-supplied input before injecting it into the DOM structure. Consequently, any JavaScript code embedded within a comment is executed by the browser as part of the animation rendering process rather than being treated as plain text.
The operational impact of this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that will execute whenever another user accesses an infected page. Since no authentication is required to post comments on many WordPress sites, any visitor can serve as a vector for delivering malicious payloads. Successful exploitation enables session hijacking, where the attacker steals administrative cookies or user tokens to impersonate legitimate users. It also facilitates defacement of the website content, redirection of visitors to phishing sites designed to steal credentials, and potentially the installation of further malware on client machines through drive-by downloads if combined with other exploits. The persistence of stored XSS makes this particularly dangerous as it affects every visitor who views the compromised page until remediation occurs.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, because the script executes in the context of the victim's browser after being stored on the server, it fits the profile of Stored DOM-Based XSS where client-side scripts process data from an insecure source like a database or comment field without adequate validation. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution within a browser environment, which is often used for initial access persistence and credential theft in web application attacks.
Mitigation strategies should prioritize immediate updates to the latest version of the Greenshift plugin where these sanitization issues have been addressed by the developers. Until an update can be applied, administrators may consider disabling comments on affected pages or restricting comment posting privileges to authenticated users with elevated roles if feasible within their site architecture. Additionally, implementing a Web Application Firewall that includes rules for detecting and blocking common XSS payloads in POST requests related to comment submissions can provide a layer of defense against exploitation attempts. Regular security audits focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities from being introduced during future plugin development or custom code integration.