The Colibri Page Builder plugin is vulnerable to stored cross‑site scripting through the comment parameter in all versions up to and including 1.0.390, identified as a CWE‑79 weakness. The plugin’s input sanitization is inadequate and its output escaping is incomplete, allowing malicious SVG elements with arbitrary data-* attributes to be stored. When a user visits a page containing a stored comment, the globally enqueued colibri.js reads the data-target value via jQuery.data(), decodes any HTML entities, and passes the result directly into jQuery(), which interprets a leading ‘<’ as HTML and executes any embedded event handlers. As a result, an attacker can inject arbitrary scripts that run in the browsers of any visitor to the affected page, potentially leading to session hijacking, defacement, or credential theft.

Affected systems include the Colibri Page Builder plugin for WordPress under the vendor extendthemes:Colibri Page Builder. All releases versioned 1.0.390 or earlier are impacted. No specific version ranges beyond the upper bound are listed, so any installation of the plugin on its latest known vulnerable release carries the risk.

The risk profile is moderate to high, reflected in a CVSS score of 7.2. Exploitation requires no authentication; an attacker only needs to submit a crafted comment via the plugin’s form. The EPSS score is not available, but the lack of a KEV listing suggests the vulnerability has not yet been widely exploited in the wild. Nevertheless, because the payload is stored and executed automatically for all users accessing the affected page, the potential impact is significant and the barrier to exploitation is low.