Colibri Page Builder vulnerabilities | LiveThreat CVE Feed

Product

Colibri Page Builder

by extendthemes · last CVE Oct 16, 2026

CVEs

On KEV

7.2

Max CVSS

New 30D

Vulnerabilities20 In the news0 Timeline

Severity mix

Critical 0High 1Medium 19Low 0

Severity

All severities20 Critical0 High1 Medium19 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Colibri Page Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-107758	7.2	0%	Oct 16	Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments Affected: through 1.0.390
CVE-2025-11747	6.4	0%	Dec 19	Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 1.0.345
CVE-2025-11376	6.4	0%	Dec 13	Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 1.0.335
CVE-2025-9560	6.4	0%	Oct 11	Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode Affected: through 1.0.334
CVE-2024-5020	6.4	0%	Dec 4	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Affected: through 1.0.286
CVE-2025-59593	5.9	0%	Oct 22	WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability Affected: before 1.0.334
CVE-2025-32185	5.4	0%	Apr 4	WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability Affected: before 1.0.332
CVE-2024-4451	5.4	0%	Jun 7	Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode Affected: through 1.0.276
CVE-2024-5038	5.4	0%	Jun 6	Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 1.0.276
CVE-2024-3340	5.4	0%	May 2	The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versions up to, and… Affected: before 1.0.274
CVE-2024-3338	5.4	0%	May 2	The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to… Affected: before 1.0.274
CVE-2024-3337	5.4	0%	May 2	The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versions up to, and… Affected: before 1.0.274
CVE-2024-2839	5.4	0%	Apr 2	The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including,… Affected: before 1.0.270
CVE-2023-6988	5.4	0%	Jan 11	The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and… Affected: through 1.0.239
CVE-2023-50833	5.4	0%	Dec 21	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects… Affected: through 1.0.239
CVE-2023-2188	4.9	1%	Aug 31	The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the… Affected: before 1.0.229
CVE-2024-28004	4.3	0%	Mar 28	Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248 Affected: before 1.0.249
CVE-2024-1870	4.3	0%	Mar 9	The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in… Affected: before 1.0.263
CVE-2024-1362	4.3	0%	Feb 23	The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253 Affected: before 1.0.260
CVE-2024-1361	4.3	0%	Feb 23	The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253 Affected: before 1.0.260