Skip to main content

Colibri Page Builder CVE-2025-59593

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2025-10-22 audit@patchstack.com
WordPress XSS Colibri Page Builder Wordpress Plugin Extendthemes
5.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.9 MEDIUM
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 18:35 vuln.today
CVE Published
Oct 22, 2025 - 15:15 cve.org
MEDIUM 5.9

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

AnalysisAI

Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).

More in Colibri Page Builder

View all
CVE-2023-50833 MEDIUM POC
6.5 Dec 21

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colib
CVE-2023-2188 HIGH
7.2 Aug 31

The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and
CVE-2025-32185 MEDIUM
6.5 Apr 04

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Coli
CVE-2024-4451 MEDIUM
6.4 Jun 07

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_vide
CVE-2024-5038 MEDIUM
6.4 Jun 06

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s)
CVE-2024-3337 MEDIUM
6.4 May 02

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_bre
CVE-2023-6988 MEDIUM
6.4 Jan 11

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_build
CVE-2024-2839 MEDIUM
6.4 Apr 02

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_pos
CVE-2024-3340 MEDIUM
5.4 May 02

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gal
CVE-2024-28004 MEDIUM
5.4 Mar 28

Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.0.248. Rated medium severity (CVSS 5.4), this v
CVE-2024-3338 MEDIUM
4.4 May 02

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter

CVE-2024-1362 MEDIUM
4.3 Feb 23

The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2025-59593 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy