Is CVE-2026-107627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107627 being exploited in the wild.

How severe is CVE-2026-107627?

Medium severity, with a CVSS score of 5.4, published 29 October 2026.

Which products and versions are affected?

Greenshift – animation and page builder blocks up to and including 13.2.1.

Is there a fix for CVE-2026-107627?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107627 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107627?

Check whether you run Greenshift – animation and page builder blocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107627: Greenshift animation and page builder blocks stored DOM-based XSS

CVE-2026-107627 · Severity: medium · CVSS 5.4 · Published 2026-10-29

The Greenshift plugin for WordPress is an animation and page builder tool used to create dynamic content blocks. A flaw in how the plugin handles user comments allows attackers to inject malicious scripts that run in the browsers of anyone viewing affected pages, potentially stealing credentials or redirecting users to malicious sites. Exploitation requires a specific page configuration with nested blocks that the attacker would need to be present.

Technologies: Greenshift – animation and page builder blocks. Vendors: Greenshift.

Quick answers

Is CVE-2026-107627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107627 being exploited in the wild.
How severe is CVE-2026-107627?: Medium severity, with a CVSS score of 5.4, published 29 October 2026.
Which products and versions are affected?: Greenshift – animation and page builder blocks up to and including 13.2.1.
Is there a fix for CVE-2026-107627?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107627 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107627?: Check whether you run Greenshift – animation and page builder blocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Stored DOM-based XSS vulnerability in the gs-textanimate script due to insufficient sanitization and output escaping of the 'comment' parameter. The vulnerability is triggered when a Latest Comments block with excerpts enabled is nested within a Text Animated block set to display Blocks content, causing the script to process comment excerpts unsafely. Unauthenticated attackers can inject arbitrary JavaScript that executes in users' browsers when they visit pages containing this configuration.

Affected products

Greenshift Greenshift – animation and page builder blocks up to and including 13.2.1

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.