CVE-2026-107758 extendthemes CVE debrief

Who should care

Defenders responsible for WordPress installations with the Colibri Page Builder plugin should assess exposure and prioritize verification and remediation. They must verify and update the Colibri Page Builder plugin to prevent exploitation, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verification and remediation to prevent exploitation.

• Defenders must verify and update the Colibri Page Builder plugin to prevent exploitation
• Injected scripts can execute on user-accessed pages, potentially leading to unauthorized actions

Technical summary

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter. The vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler. Defenders should be

Defensive priority

Defenders should prioritize verifying and updating the Colibri Page Builder plugin to prevent exploitation of this vulnerability.

Recommended defensive actions

• Verify the Colibri Page Builder plugin version and update to a patched version if necessary
• Implement input sanitization and output escaping for user-supplied data
• Monitor for suspicious activity and injected scripts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists due to the widened comment allow-list permitting SVG elements with arbitrary data-* attributes and the colibri.js script reading the stored data-target value via jQuery.data().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.