CVE-2025-9560: Colibri Page Builder XSS Vulnerability

CVE-2025-9560 Overview

CVE-2025-9560 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress. The flaw affects all versions up to and including 1.0.334. The issue resides in the plugin's colibri_newsletter shortcode, which fails to sanitize input and escape output for user-supplied attributes. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who accesses the affected page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist arbitrary JavaScript in WordPress pages, enabling session theft, credential harvesting, and administrative account takeover when higher-privileged users view the injected content.

Affected Products

Colibri Page Builder plugin for WordPress
All versions up to and including 1.0.334
Sites permitting contributor-level (or higher) user registration

Discovery Timeline

2025-10-11 - CVE-2025-9560 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9560

Vulnerability Analysis

The vulnerability exists in the colibri_newsletter shortcode handler located at extend-builder/shortcodes/newsletter.php. The shortcode accepts attributes supplied by the user and renders them directly into the page output. Because the plugin does not sanitize input on receipt nor escape output on render, script payloads embedded in shortcode attributes are stored in post content and served to visitors. Any authenticated user permitted to edit posts, including contributors awaiting review, can introduce the shortcode with malicious attributes. When an editor, administrator, or unauthenticated visitor loads the page, the injected script executes in the victim's browser context under the site's origin.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attribute values inside the newsletter shortcode. WordPress provides functions such as sanitize_text_field(), esc_attr(), and esc_html() for these purposes, and the vulnerable handler did not invoke them on all attribute values before rendering. The upstream fix, referenced in the WordPress plugin change log, adds proper escaping to the affected attributes.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with contributor privileges or higher. The attacker submits a post or page containing the colibri_newsletter shortcode with a crafted attribute value carrying a JavaScript payload. Because the scope changes from the attacker's session to the victim's, the resulting execution can perform actions on behalf of higher-privileged users, including modifying content, creating administrator accounts, or exfiltrating cookies and session tokens.

No public proof-of-concept exploit code has been published. For technical background, see the Wordfence vulnerability report.

Detection Methods for CVE-2025-9560

Indicators of Compromise

Post or page content containing [colibri_newsletter ...] shortcodes with attribute values holding <script>, on*= event handlers, or javascript: URIs.
Unexpected outbound requests from browsers loading pages that render the newsletter shortcode.
New administrator accounts, altered user roles, or unauthorized plugin installations following contributor activity.

Detection Strategies

Query the wp_posts table for post_content values containing colibri_newsletter combined with script tags or event-handler attributes.
Review WordPress audit logs for contributor-level users who created or edited posts that include the vulnerable shortcode.
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to /wp-admin/post.php and /wp-json/wp/v2/posts for shortcode attribute values containing HTML script constructs.

Monitoring Recommendations

Alert on privilege changes and administrator account creation events in WordPress user metadata.
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on pages rendering plugin shortcodes.
Track plugin file integrity for extend-builder/shortcodes/newsletter.php to confirm the patched version is in place.

How to Mitigate CVE-2025-9560

Immediate Actions Required

Update the Colibri Page Builder plugin to a version later than 1.0.334 that includes the fix from changeset 3373432.
Audit all posts and pages containing the colibri_newsletter shortcode and remove or sanitize suspicious attribute values.
Review recent contributor activity and rotate credentials for any accounts suspected of injecting payloads.

Patch Information

The vendor addressed the flaw by adding proper input sanitization and output escaping to the colibri_newsletter shortcode handler. The fix is committed in changeset 3373432 on the WordPress plugin repository. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Restrict contributor-level and above accounts to trusted users only until the patch is applied.
Temporarily deactivate the Colibri Page Builder plugin on sites that cannot update immediately.
Enforce a strict Content Security Policy that disallows inline scripts to blunt the impact of stored XSS payloads.

bash

# Update the plugin using WP-CLI
wp plugin update colibri-page-builder

# Verify the installed version
wp plugin get colibri-page-builder --field=version

# Search post content for the vulnerable shortcode pattern
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%colibri_newsletter%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"