Colibri Page Builder CVE-2025-9560

Exploitation requires an authenticated account with contributor-level privileges or higher on a WordPress site running Colibri Page Builder version 1.0.334 or earlier, plus the ability to insert the colibri_newsletter shortcode into page content. The payload is delivered through unsanitized/unescaped user-supplied shortcode attributes and fires as Stored XSS when any user subsequently renders the affected page (no interaction needed from the attacker at execution time). Limiting factors: it is NOT remote-unauthenticated - an attacker must first obtain a contributor+ account, so single-admin or closed-registration sites have little exposure; the plugin must be installed and active at a vulnerable version; and impact is confined to script execution in the victim's browser context (no direct server compromise).

This is a moderate-severity, authenticated Stored XSS (CWE-79) with multiple signals pointing to limited real-world urgency rather than critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates network reach and low complexity but requires privileges (PR:L) - specifically contributor-level WordPress access - which materially gates exploitation to users who already hold an account on the target site. The scope change (S:C) correctly reflects that the injected script executes in the browser of a different security context (any visitor/admin viewing the page), but confidentiality and integrity impact are only Low and availability is None. EPSS reinforces low near-term exploitation likelihood at 0.23% (13th percentile). There is no CISA KEV listing and no public exploit code identified in the provided data, so there is no evidence of active exploitation. There is no SSVC decision data supplied. No signals conflict here: a low EPSS, absent KEV, and an authenticated/privileged prerequisite all align to make this a routine patch-on-cycle item rather than an emergency - the main residual risk is on multi-author sites where untrusted contributors exist.

A multi-author WordPress site allows contributor-level accounts (e.g., guest bloggers). A malicious or compromised contributor inserts a colibri_newsletter shortcode with crafted attributes containing a JavaScript payload into a draft page; because attributes are not sanitized or escaped, the script is stored and later executes in the browser of any administrator or visitor who views the page, enabling session/cookie theft or admin-action abuse. No public exploit code is identified at time of analysis, so exploitation currently requires an attacker to craft the payload manually.