Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

15 records

Vendor: extendthemes Component: Colibri Page Builder Clear all filters
TI-2025-37123 CVE-2025-59593 · GHSA-fxq4-7g4f-6h77

WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: fro…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00225 Published 2025-10-22 No fix listed CWE-79
TI-2025-23283 CVE-2025-32185 · GHSA-h2pq-33qq-62jg

WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: fro…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00414 Published 2025-04-04 No fix listed CWE-79
TI-2024-04141 CVE-2024-4451 · GHSA-3w78-v9jq-vw22

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 28

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-06-07 No fix listed CWE-79
TI-2024-04679 CVE-2024-5038 · GHSA-99gj-25m6-38xr

Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-06-06 No fix listed CWE-79
TI-2024-03124 CVE-2024-3340 · GHSA-r45f-4gg8-w8cc

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 25

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versions up to, and including, 1.0.272 due to insufficient input sa…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00449 Published 2024-05-02 No fix listed CWE-79
TI-2024-03122 CVE-2024-3337 · GHSA-m47f-2rm6-hhj4

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 29

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versions up to, and including, 1.0.272 due to insufficient input s…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00423 Published 2024-05-02 No fix listed CWE-79
TI-2024-03123 CVE-2024-3338 · GHSA-gf9p-76p3-4hqw

Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting

Priority LOW 25

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input sanitization and output esca…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00424 Published 2024-05-02 No fix listed CWE-79
TI-2024-02649 CVE-2024-2839 · GHSA-pm9h-cgmx-g7vq

Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including, 1.0.263 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2024-04-02 No fix listed CWE-79
TI-2024-01739 CVE-2024-1870 · GHSA-6pw4-99gp-9gj7

Colibri Page Builder <= 1.0.260 - Missing Authorization

Priority LOW 20

The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00406 Published 2024-03-09 No fix listed CWE-862
TI-2023-06389 CVE-2023-6988 · GHSA-fv4q-v79m-93hj

Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanit…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0037 Published 2024-01-11 No fix listed CWE-79
TI-2023-27738 CVE-2023-50833 · GHSA-9xgp-crr8-rrpg

WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0037 Published 2023-12-21 No fix listed CWE-79
TI-2023-02052 CVE-2023-2188 · GHSA-4wfg-7c3p-cjr8

Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id

Priority LOW 35

The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter and lack of sufficie…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00847 Published 2023-08-31 No fix listed CWE-89