The Greenshift – animation and page builder blocks plugin contains a stored DOM-Based Cross‑Site Scripting flaw that arises when the comment author URL field is not properly sanitized or escaped. When an attacker posts a comment with a malicious URL, and the page uses an Interaction Layer attach‑attribute action that copies that URL into a Counter block’s data‑prefix or data‑postfix attribute, the browser will execute the embedded script for every visitor who loads the Counter block. This enables arbitrary JavaScript execution in the site’s context, potentially allowing session hijacking, cookie theft, defacement or phishing attacks. The vulnerability is driven by unsanitized user input stored in the comment record and later rendered by the plugin’s Counter component.

The affected product is the Greenshift – animation and page builder blocks plugin for WordPress, distributed by wpsoul. Versions up to and including 13.2.2 are vulnerable. No specific sub‑versions are listed beyond the upper bound of 13.2.2.

The CVSS score of 5.4 indicates a moderate severity level. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation to date. However, exploitation requires unauthenticated access to the comment interface and that the site’s pages contain the vulnerable Interaction Layer configuration. If both conditions are present, any page visitor can be exposed to malicious script execution.