CVE-2026-107758— Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
Quick assessment
Affected
extendthemes Colibri Page Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Colibri Page Builder 插件在所有 1.0.390 及之前的版本中，由于输入清理和输出转义不足，存在存储型跨站脚本（Stored XSS）漏洞，攻击向量为 参数。该漏洞允许未认证的攻击者在页面上注入任意 Web 脚本，当用户访问被注入的页面时，这些脚本将被执行。注入的恶意负载之所以能够持久保存，是因为放宽后的评论白名单允许包含任意 属性的 SVG 元素；而执行之所以发生，是因为 作为全局资源在每个前端页面加载，它通过 jQuery 的 方法读取存储的 值（该方法会对 HTM
Possible ATT&CK Techniques 1 AI
T1193
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107758
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
Source: CVE Program / CVE List V5
Vulnerability Description
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| extendthemes | Colibri Page Builder | 0 ~ 1.0.390 | - |
|
II. Public POCs for CVE-2026-107758
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107758
请登录查看更多情报信息。
Other References for CVE-2026-107758 (6)
IV. Related Vulnerabilities
Same product: Colibri Page Builder
-
CVE-2025-11747
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor -
CVE-2025-11376
Colibri Page Builder <= 1.0.335 - Authenticated (Contributor -
CVE-2025-59593
WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site -
CVE-2025-9560
Colibri Page Builder <= 1.0.334 - Authenticated (Contributor -
CVE-2025-32185
WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Sit
Same vendor: extendthemes
-
CVE-2026-109191
Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive I -
CVE-2026-100107
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cros -
CVE-2026-14472
Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+ -
CVE-2026-16779
Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Au -
CVE-2026-5427
Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Au
Same weakness: CWE-79
-
CVE-2026-104726
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stor -
CVE-2026-109224
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Script -
CVE-2026-93681
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-96870
SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-100106
FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cr
V. Comments for CVE-2026-107758
No comments yet