CVE-2023-6988 in Colibri Page Builder Plugin
Summary
by MITRE • 01/11/2024
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/11/2026
The CVE-2023-6988 vulnerability resides within the Colibri Page Builder plugin for WordPress, representing a critical stored cross-site scripting flaw that affects versions through 1.0.239. This vulnerability specifically targets the extend_builder_render_js shortcode functionality, which serves as a legitimate plugin feature for rendering dynamic content on WordPress sites. The flaw emerges from inadequate input sanitization and output escaping mechanisms that fail to properly validate or sanitize user-supplied attributes before processing them within the plugin's rendering pipeline. Security researchers have identified that this vulnerability creates a persistent XSS vector that can be exploited by authenticated attackers who possess contributor-level permissions or higher, making it particularly concerning given the relatively low privilege requirements needed for exploitation.
The technical implementation of this vulnerability allows malicious actors to inject arbitrary JavaScript code through the plugin's shortcode processing mechanism. When an attacker with sufficient privileges creates or modifies a page using the extend_builder_render_js shortcode with malicious attributes, the injected script becomes permanently stored within the WordPress database. This stored payload executes whenever any user accesses the affected page, including administrators or other privileged users who may view the content. The vulnerability operates at the application layer and leverages the trust relationship between the WordPress platform and its plugins, exploiting the expectation that user inputs within legitimate plugin features will be properly sanitized before execution.
The operational impact of CVE-2023-6988 extends beyond simple script injection, as it enables attackers to potentially escalate privileges, steal session cookies, perform unauthorized actions within the WordPress admin interface, or redirect users to malicious sites. The stored nature of the vulnerability means that the malicious payload persists even after the initial attack vector is closed, creating a long-term threat that can affect multiple users over time. This makes the vulnerability particularly dangerous in environments where multiple contributors or editors have access to the WordPress platform, as a single compromised account can lead to widespread script execution across the site's content. The attack vector aligns with CWE-79 which specifically addresses cross-site scripting vulnerabilities, and the exploitation pattern follows ATT&CK technique T1566.001 for initial access through malicious content.
Mitigation strategies for this vulnerability should include immediate patching of the Colibri Page Builder plugin to version 1.0.240 or later, which contains the necessary sanitization and escaping fixes. Organizations should also implement additional security measures such as restricting contributor-level permissions to only essential functions, implementing content security policies to limit script execution, and conducting regular security audits of plugin installations. Network monitoring should be enhanced to detect unusual shortcode usage patterns, and administrators should consider implementing web application firewalls that can detect and block malicious script injection attempts. Regular security training for content editors and contributors can help prevent accidental exploitation through social engineering or phishing attacks that might compromise accounts with sufficient privileges to utilize the vulnerable plugin features. The vulnerability demonstrates the importance of proper input validation and output escaping practices as outlined in OWASP top ten security controls and represents a clear example of how insufficient sanitization can create persistent security risks in content management systems.