CVE-2025-59593

WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

View on CVE.org
Published Oct 22, 2025 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

Analysis

AI-generated

Technical impact

The plugin has a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into pages viewed by other users. This results in potential theft of session cookies, defacement, or redirection to malicious sites, compromising both confidentiality and integrity of user data.

Affected Systems

The issue applies to the Extend Themes Colibri Page Builder plugin for WordPress in all versions up to but not including 1.0.334. Any WordPress site that has the plugin installed is affected.

Risk and Exploitability

The CVSS score of 5.9 denotes moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by embedding malicious script payloads that are stored and served to all site visitors who load the affected content, creating a persistent attack vector.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Colibri Page Builder to version 1.0.334 or later to remove the stored XSS flaw.
  • If an immediate update is not possible, deactivate or uninstall the plugin to eliminate the vulnerability surface.
  • As a temporary containment measure, enforce input sanitization on all content rendered by the plugin, for example using WordPress’s wp_kses or related functions.

Generated by OpenCVE AI on April 29, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}
Type Values Removed Values Added
CPEs cpe:2.3:a:extendthemes:colibri_page_builder:*:*:*:*:*:wordpress:*:*
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'}
Type Values Removed Values Added
First Time appeared Extendthemes
Extendthemes colibri Page Builder
Wordpress
Wordpress wordpress
Vendors & Products Extendthemes
Extendthemes colibri Page Builder
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.
Title WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Earlier changes (6)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Sep 17, 2025, 6:01 PM

View source JSON

Updated
Oct 22, 2025, 7:28 PM

JSON

Status
Modified
Published
Oct 22, 2025, 3:15 PM
Modified
Oct 23, 2026, 10:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 11:45 PM

JSON