Colibri Page Builder CVE-2026-107758

No authentication and no victim interaction are required to inject the payload (PR:N/UI:N): any user who can submit a comment on a site running Colibri Page Builder (versions ≤ 1.0.390) can store the XSS. The specific prerequisite is that the plugin's widened comment SVG allow-list permits SVG elements with arbitrary data-* attributes, and that colibri.js is enqueued globally on front-end pages - both are default behaviors of the affected plugin versions per the description. Execution is triggered when any user subsequently accesses the injected page, so the only limiting factor is that a victim must view the affected page; sites that disable comments or do not run this plugin version are not exposed.

This is a genuinely notable issue rather than a high-CVSS-but-low-real-risk one, though the raw score overstates absolute danger. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) is internally consistent with the description: a stored XSS that any unauthenticated attacker can inject and that fires for any visitor of the affected page, with scope change (S:C) reflecting the attacker crossing into the victim's browser context. The HIGH rating is driven mostly by the no-privilege, no-interaction injection path plus scope change, not by catastrophic impact - confidentiality and integrity are only Low and availability is None, which is typical for reflected/stored XSS. Signals are partly MISSING: no EPSS probability, no CISA KEV listing, and no explicit POC flag are present in the input, so exploitation likelihood cannot be quantified. The exploitation status is therefore 'no public exploit identified at time of analysis' (POC=NO, KEV=NO). The mechanism is unusually well-documented (SVG kses allow-list widening plus jQuery.data() entity-decoding into jQuery() HTML parsing), and the reporting source is Wordfence, which lends credibility; combined with WordPress plugins being a mass-scanned attack surface, exploitation is plausible once the advisory is public, but there is no confirmation of active or widespread exploitation at this time.

An unauthenticated attacker submits a comment containing an SVG element with a crafted data-target attribute whose value begins with '<' and embeds an event handler, which passes the plugin's widened SVG allow-list and is stored. When any visitor (or an administrator reviewing content) later loads a front-end page, the globally enqueued colibri.js reads the stored value via jQuery.data(), HTML-entity-decodes it, and feeds it to jQuery(), executing the attacker's script in the victim's browser session. No public exploit code is identified in the input, but the referenced source files pinpoint the exact sink, making a working exploit straightforward to construct.