Stored XSS in Colibri Page Builder Plugin for WordPress

The Colibri Page Builder plugin for WordPress (versions 1.0.390 and earlier) contains a critical stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-107758. The flaw stems from insufficient input sanitization and output escaping within the plugin's comment-handling logic. Attackers can submit crafted comments containing SVG elements with malicious data-* attributes, which are improperly permitted by the plugin's sanitization allow-list.

The vulnerability is triggered because the plugin's front-end script, colibri.js, is enqueued globally. This script retrieves the stored malicious data-target value using jQuery.data(). Because jQuery.data() automatically performs HTML-entity decoding on retrieved attributes, the decoded malicious payload is subsequently passed to the jQuery() constructor. When the constructor identifies a leading '<' character, it interprets the payload as HTML, causing any embedded event handlers (such as 'onerror') to execute in the browser of any user viewing the injected page. This impact is significant as it allows unauthenticated attackers to execute arbitrary JavaScript, potentially leading to session hijacking or unauthorized administrative actions.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user viewing an affected page, including site administrators. This can lead to full site compromise through administrative account takeover, unauthorized data modification, or the redirection of users to malicious third-party content.

Recommendation

• Immediately upgrade Colibri Page Builder to a version beyond 1.0.390 that incorporates proper input sanitization and output escaping.
• Audit WordPress comment logs for entries containing SVG tags or unexpected 'data-' attributes if the plugin remains temporarily active.
• Deploy web application firewall (WAF) rules to detect and block incoming HTTP POST requests containing suspicious SVG tag structures or dangerous HTML event handlers targeted at WordPress comment endpoints.