CVE-2025-32185: Colibri Page Builder Stored XSS Vulnerability

CVE-2025-32185 Overview

CVE-2025-32185 is a stored cross-site scripting (XSS) vulnerability in the Extend Themes Colibri Page Builder plugin for WordPress. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Authenticated attackers with low-level privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The vulnerability affects all versions of colibri-page-builder up to and including 1.0.329. Exploitation requires user interaction and can lead to session theft, forced browser actions, and unauthorized administrative changes within the WordPress environment.

Critical Impact
Authenticated contributors can store JavaScript payloads that execute against site visitors and administrators, enabling session hijacking and content manipulation across the WordPress site.

Affected Products

Extend Themes Colibri Page Builder for WordPress
All versions from n/a through 1.0.329
WordPress sites with the colibri-page-builder plugin installed and active

Discovery Timeline

2025-04-04 - CVE-2025-32185 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32185

Vulnerability Analysis

The vulnerability is a stored XSS issue affecting the Colibri Page Builder plugin, a drag-and-drop page builder for WordPress. Input supplied through builder components is stored in the WordPress database and rendered back to users without proper output encoding or sanitization. Because the payload persists across requests, every user who loads an affected page executes the attacker-controlled script in their browser session.

The attack requires network access, low privileges, and user interaction. The scope is changed, meaning the injected script executes in a security context beyond the initially vulnerable component, typically the browser session of an authenticated administrator. Refer to the Patchstack Vulnerability Report for advisory details.

Root Cause

The root cause is missing or insufficient input validation and output encoding in one or more Colibri Page Builder components. Content entered through builder fields is stored verbatim and later rendered into the page HTML without contextual escaping. This allows <script> tags and JavaScript event handlers to survive the storage and rendering pipeline.

Attack Vector

An attacker with contributor-level or higher WordPress credentials submits a crafted payload through a vulnerable Colibri Page Builder field. The payload is stored in the WordPress database. When an administrator or another user visits the affected page or preview, the stored script executes in their browser under the site's origin. This enables cookie theft, forced administrative actions through the WordPress REST API, plugin installation, or account creation.

No verified proof-of-concept code has been published. See the Patchstack advisory for technical details.

Detection Methods for CVE-2025-32185

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in WordPress wp_posts or wp_postmeta entries associated with Colibri Page Builder content
Outbound requests from administrator browsers to unfamiliar domains shortly after loading a Colibri-built page
Unauthorized creation of WordPress administrator accounts or installation of new plugins following contributor logins
Suspicious changes to page templates edited through the Colibri Page Builder interface

Detection Strategies

Audit database records for Colibri-managed content and flag entries containing HTML script constructs or encoded JavaScript
Deploy a web application firewall rule set that inspects builder POST requests for XSS payload patterns
Enable WordPress activity logging to track edits by contributor and author roles on pages containing Colibri components
Correlate administrator session anomalies with recent page edits performed by lower-privileged accounts

Monitoring Recommendations

Monitor plugin version reporting across WordPress fleets to identify hosts running colibri-page-builder at or below version 1.0.329
Log and review all changes to WordPress user roles, capabilities, and administrator accounts
Enable Content Security Policy (CSP) violation reporting to detect script executions from unexpected sources
Alert on outbound HTTP requests from wp-admin sessions to previously unseen third-party domains

How to Mitigate CVE-2025-32185

Immediate Actions Required

Update Colibri Page Builder to the latest patched release published after version 1.0.329
Review contributor, author, and editor accounts and remove or rotate credentials for accounts no longer required
Inspect existing Colibri-built pages for injected script content and remove any unauthorized markup
Force password resets for administrator accounts if suspicious activity is observed following the disclosure

Patch Information

Extend Themes has addressed the issue in a release subsequent to 1.0.329. Refer to the Patchstack Vulnerability Report and the plugin's changelog on the WordPress plugin repository for the specific fixed version. Apply the update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Restrict use of the Colibri Page Builder to trusted administrator accounts until the plugin is updated
Deploy a Content Security Policy that disallows inline scripts on WordPress pages to reduce XSS impact
Enable a web application firewall with WordPress-specific rule sets to filter XSS payloads at the edge
Temporarily deactivate the Colibri Page Builder plugin on production sites where trusted upgrade is not immediately feasible

bash

# Update Colibri Page Builder using WP-CLI
wp plugin update colibri-page-builder --version=latest
wp plugin list --name=colibri-page-builder --fields=name,status,version