CVE-2025-9560

Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode

View on CVE.org

Published Oct 11, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The Colibri Page Builder plugin for WordPress is vulnerable to stored Cross‑Site Scripting. The colibri_newsletter shortcode fails to sanitize or escape user‑supplied attributes, enabling an authenticated user with contributor‑level access or greater to store malicious script code that will run whenever a page containing the shortcode is viewed.

Affected Systems

The vulnerability affects the ExtendThemes Colibri Page Builder plugin, all released versions up to and including 1.0.334. Any WordPress installation that has installed this plugin and created or edited a page using the colibri_newsletter shortcode is potentially impacted.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with contributor or higher privileges to inject code, but once injected, the malicious script runs for any visitor to the affected page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

extendthemes

Colibri Page Builder

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.334

No data.

Vendor	Product	Versions
Extendthemes	Colibri Page Builder	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Colibri Page Builder to a version newer than 1.0.334, which removes the input sanitization flaw.
If an update cannot be applied immediately, remove or disable the colibri_newsletter shortcode from all pages and prevent contributors or higher from adding it.
After disabling the shortcode, review existing pages for injected content and cleanse any user data that may contain malicious script before restoration of the shortcode.
Restrict contributor permissions or temporarily revoke contributor access until the plugin is updated, to prevent further injection of scripts.
Configure the site to serve the affected pages with strict Content‑Security Policy headers that block inline script execution, mitigating the impact of any scripts that may already be embedded.

Generated by OpenCVE AI on April 22, 2026 at 16:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.237% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php
https://wordpress.org/plugins/colibri-page-builder/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve

History

Oct 20, 2025 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Extendthemes Extendthemes colibri Page Builder Wordpress Wordpress wordpress
Vendors & Products		Extendthemes Extendthemes colibri Page Builder Wordpress Wordpress wordpress

Oct 14, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 11, 2025 2:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php https://wordpress.org/plugins/colibri-page-builder/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`