Stored Cross-Site Scripting Vulnerability in Colibri Page Builder Plugin for WordPress

CVE-2026-107758

What is CVE-2026-107758?

The Colibri Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to its inadequate input sanitization and output escaping mechanisms. This vulnerability can be exploited by unauthenticated attackers who can inject arbitrary web scripts into the comment parameter. When a user accesses a page with the injected script, it gets executed, potentially leading to data theft or further exploitation. The vulnerability arises from a permissive allow-list for SVG elements that permits the inclusion of arbitrary data attributes. The issues are compounded as the globally enqueued colibri.js file reads the stored data, decoding any HTML entities which can result in embedded script execution.

References