CVE-2026-107758

7.2High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated remote attackers can execute arbitrary JavaScript in the browsers of visiting users and admins. They only need network access to submit a comment containing a crafted payload.

Root cause

The plugin allows SVG tags with arbitrary data-* attributes in comments and then passes the unescaped data-target attribute straight into jQuery() via colibri.js.

Affected systems

Colibri Page Builder plugin for WordPress versions up to and including 1.0.390

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a version newer than 1.0.390 once available. If patching immediately is not possible, disable comments across the site or deactivate the Colibri Page Builder plugin.

shell

$ wp plugin update colibri-page-builder

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-107758