CVE-2026-107627
Received Received - Intake

Stored DOM-Based XSS in Greenshift WordPress Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: Wordfence

Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-107627
EUVD
EUVD-2026-112686

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpsoul Greenshift – animation and page builder blocks 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored DOM-Based Cross-Site Scripting (XSS) flaw in the Greenshift plugin for WordPress. It exists due to insufficient input sanitization and output escaping in the 'comment' parameter. Attackers can inject malicious scripts into pages that execute when users access them.

Detection Guidance

This vulnerability requires specific WordPress plugin conditions to be present. Check if the Greenshift plugin is installed and verify its version. Look for pages with Text Animated blocks containing Animated Texts values and Latest Comments blocks with excerpts enabled nested inside.

Impact Analysis

Unauthenticated attackers can inject arbitrary web scripts into pages. If an administrator meets specific conditions (e.g., using certain blocks with comment excerpts), the injected scripts will execute when users visit those pages, potentially stealing data or performing actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using the affected plugin may face compliance breaches if exploited.

Mitigation Strategies

Update the Greenshift plugin to the latest version immediately. If an update is not available, consider disabling the plugin temporarily until a patch is released. Review all pages for suspicious scripts in comment sections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart