CVE-2026-107758 in Colibri Page Builder Plugin
Summary
by MITRE • 10/16/2026
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Colibri Page Builder plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.0.390, classified under CWE-79 as an Improper Neutralization of Input During Web Page Generation commonly known as Stored Cross-Site Scripting or Persistent XSS. This flaw arises from insufficient input sanitization and output escaping mechanisms within the plugin's handling of user-supplied data. Specifically, the vulnerability is triggered through the comment parameter, which allows unauthenticated attackers to inject arbitrary web scripts into stored content. Unlike reflected XSS where malicious payloads are executed immediately via a crafted link, this persistent variant ensures that the injected payload survives storage in the database and executes whenever any user accesses an affected page, thereby increasing the potential impact by exposing all visitors of the compromised site to the attack vector without requiring them to click on specific links or perform additional actions beyond normal browsing.
The technical root cause lies in a permissive allow-list configuration that permits SVG elements with arbitrary data attributes within comments. When a user submits a comment containing an SVG element equipped with malicious data-target attributes, this input is stored in the WordPress database without adequate validation to strip dangerous content or encode special characters appropriately. The execution mechanism relies on the global JavaScript file colibri.js, which is enqueued on every front-end page of sites using the plugin. This script actively reads the stored data-target value from the DOM elements and passes it into jQuery.data(). Crucially, jQuery's internal implementation performs HTML-entity decoding on these values before returning them to the application logic. The decoded string is then passed directly into the jQuery() function for further processing. Because the jQuery constructor interprets a leading less-than character as the start of an HTML tag, it parses the injected content as DOM elements rather than plain text. This parsing process triggers embedded event handlers within the malicious SVG structure, resulting in the immediate execution of arbitrary JavaScript code in the context of the victim's browser session and with the privileges associated with that site.
The operational impact of this vulnerability is severe due to its persistent nature and lack of authentication requirements. An unauthenticated attacker can compromise any WordPress site running a vulnerable version of Colibri Page Builder by simply posting a malicious comment on any public-facing page, such as blog posts or static pages where comments are enabled. Once the payload is stored, every subsequent visitor who loads that page will have their browser execute the injected script. This enables attackers to perform session hijacking by stealing authentication cookies and tokens, redirect users to phishing sites designed to steal credentials, deface websites by altering displayed content, or deploy further malware through drive-by download techniques. The ability to execute arbitrary code also allows for keylogging within the site's context, potentially capturing sensitive information entered into forms on that domain. Since the attack does not require user interaction beyond viewing the page, it poses a significant risk to both end-users and website administrators who may inadvertently expose their own sessions if they view compromised pages while logged in as an administrator.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary defense is to upgrade the Colibri Page Builder plugin to version 1.0.391 or later, where developers have presumably implemented stricter input validation and output encoding practices to prevent SVG elements with arbitrary data attributes from being processed in a way that leads to script execution. For sites unable to update immediately due to compatibility concerns, administrators should consider disabling comments on public-facing pages if they are not essential for the site's functionality, thereby removing the attack vector entirely. Additionally, implementing a Web Application Firewall (WAF) with rules specifically tuned to detect and block SVG elements containing event handlers or suspicious data attributes can provide an additional layer of defense against exploitation attempts. From a development perspective, adhering to OWASP guidelines requires ensuring that all user-supplied input is strictly validated against a whitelist of allowed characters and types before storage, and that output is properly encoded based on the context in which it will be rendered, such as using HTML entity encoding for data inserted into DOM attributes or JavaScript variables. Regular security audits and code reviews focusing on how third-party plugins handle dynamic content are essential to identifying similar vulnerabilities in other components of the WordPress ecosystem.