CVE-2024-1361

The CVE-2024-1361 entry concerns Colibri Page Builder for WordPress (versions

CVE-2024-1362

CVE-2024-1362 affects the Colibri Page Builder plugin for WordPress. Public disclosures and vendor data indicate a Cross-Site Request Forgery (CSRF) flaw caused by missing or incorrect nonce validation in the cp_shortcode_refresh() function, enabling unauthenticated attackers to trigger shortcode...

CVE-2023-6988

CVE-2023-6988 affects the Colibri Page Builder WordPress plugin. The vulnerability is a Stored Cross-Site Scripting in the extend_builder_render_js shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. It affects all versions up to and including 1.0...

CVE-2024-28004

Summary of CVE-2024-28004 (WordPress Colibri Page Builder): The vulnerability is a Missing Authorization flaw in ExtendThemes Colibri Page Builder (versions up to and including 1.0.248). The root cause is an unauthorized modification risk due to a missing capability check on the wp_ajax_colibri_p...

CVE-2024-1870

CVE-2024-1870 affects the WordPress plugin Colibri Page Builder . The vulnerability is an unauthorized data modification issue caused by a missing capability check in the function calledActivateLicenseEndpoint, present in all versions up to and including 1.0.260. This allows authenticated attacke...

CVE-2024-3338

The CVE-2024-3338 entry concerns Colibri Page Builder for WordPress. It enables Stored Cross-Site Scripting via the image alt data parameter in all versions up to 1.0.262 due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inj...

CVE-2024-2839

CVE-2024-2839 concerns the Colibri Page Builder plugin for WordPress. According to the connected Red Hat advisory and the initial description, all versions up to 1.0.263 are vulnerable to Stored XSS via the plugin shortcode colibri_post_title, caused by insufficient input sanitization and output ...

CVE-2025-32185

CVE-2025-32185: Colibri Page Builder suffers Stored XSS due to improper neutralization of input during web page generation. Affected software: Colibri Page Builder,

CVE-2024-3337

CVE-2024-3337 affects the Colibri Page Builder for WordPress. The vulnerability is a Stored XSS via the shortcode colibri_breadcrumb_element, present in all versions up to and including 1.0.272, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitatio...

CVE-2024-5038

CVE-2024-5038 affects Colibri Page Builder for WordPress. The vulnerability is Stored Cross-Site Scripting via the plugin’s shortcode attributes in all versions up to 1.0.276, caused by insufficient input sanitization and output escaping. It requires an authenticated attacker with contributor-lev...

CVE-2024-3340

The CVE-2024-3340 issue affects Colibri Page Builder for WordPress. It enables Stored XSS via the colibri-gallery-slideshow shortcode in all versions up to 1.0.272 due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access at...

CVE-2024-4451

The CVE-2024-4451 entry concerns Colibri Page Builder for WordPress. It describes a Stored Cross-Site Scripting (XSS) vulnerability in the colibri_video_player shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. The issue affects all versions up to an...

CVE-2023-50833

CVE-2023-50833 affects Colibri Page Builder (WordPress) via Stored Cross-Site Scripting (XSS) in shortcode processing. Vulnerable versions: Colibri Page Builder up to 1.0.239 (tests indicate patch/mitigation in 1.0.240+). Root cause per connected Red Hat/Wordfence entries points to improper neutr...

CVE-2023-2188

The CVE-2023-2188 entry concerns the WordPress Colibri Page Builder plugin. Affected software: Colibri Page Builder for WordPress, versions up to and including 1.0.227. Root cause: insufficient escaping of the post_id parameter and inadequate preparation of the existing SQL query, enabling SQL In...

CVE-2025-59593

CVE-2025-59593 affects the WordPress Colibri Page Builder plugin (Colibri Page Builder) with stored XSS due to improper neutralization of input in web page generation. Impact: stored cross-site scripting across Colibri Page Builder versions prior to 1.0.334. Remediation: update to Colibri Page Bu...