Read the docs

extendthemes

Records48All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

extendthemes records in CISA KEV

No extendthemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Colibri Page Builder 15 records LOW Materialis 2 records MEDIUM Materialis Companion 2 records MEDIUM Calliope 1 record LOW Empowerwp 1 record LOW Mesmerize 1 record MEDIUM Mesmerize Companion 1 record MEDIUM Teluro 1 record LOW

Records

15 records in Colibri Page Builder · all components

TI-2023-02052 CVE-2023-2188 · GHSA-4wfg-7c3p-cjr8

Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id

Priority LOW 35

The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter and lack of sufficie…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00847 Published 2023-08-31 No fix listed CWE-89
TI-2025-23283 CVE-2025-32185 · GHSA-h2pq-33qq-62jg

WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: fro…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00414 Published 2025-04-04 No fix listed CWE-79
TI-2024-03122 CVE-2024-3337 · GHSA-m47f-2rm6-hhj4

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 29

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versions up to, and including, 1.0.272 due to insufficient input s…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00423 Published 2024-05-02 No fix listed CWE-79
TI-2023-27738 CVE-2023-50833 · GHSA-9xgp-crr8-rrpg

WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0037 Published 2023-12-21 No fix listed CWE-79
TI-2023-06389 CVE-2023-6988 · GHSA-fv4q-v79m-93hj

Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanit…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0037 Published 2024-01-11 No fix listed CWE-79
TI-2024-04679 CVE-2024-5038 · GHSA-99gj-25m6-38xr

Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-06-06 No fix listed CWE-79
TI-2024-04141 CVE-2024-4451 · GHSA-3w78-v9jq-vw22

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 28

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-06-07 No fix listed CWE-79
TI-2024-02649 CVE-2024-2839 · GHSA-pm9h-cgmx-g7vq

Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including, 1.0.263 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2024-04-02 No fix listed CWE-79
TI-2025-37123 CVE-2025-59593 · GHSA-fxq4-7g4f-6h77

WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: fro…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00225 Published 2025-10-22 No fix listed CWE-79
TI-2024-03124 CVE-2024-3340 · GHSA-r45f-4gg8-w8cc

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 25

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versions up to, and including, 1.0.272 due to insufficient input sa…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00449 Published 2024-05-02 No fix listed CWE-79
TI-2024-03123 CVE-2024-3338 · GHSA-gf9p-76p3-4hqw

Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting

Priority LOW 25

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input sanitization and output esca…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00424 Published 2024-05-02 No fix listed CWE-79
TI-2024-01739 CVE-2024-1870 · GHSA-6pw4-99gp-9gj7

Colibri Page Builder <= 1.0.260 - Missing Authorization

Priority LOW 20

The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00406 Published 2024-03-09 No fix listed CWE-862
Open these records in search →