CVE-2025-9560

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9560", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-27T20:15:51.490Z", "datePublished": "2025-10-11T02:24:51.813Z", "dateUpdated": "2026-04-08T16:35:35.816Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:35.816Z"}, "affected": [{"vendor": "extendthemes", "product": "Colibri Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.334", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve"}, {"url": "https://wordpress.org/plugins/colibri-page-builder/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-10-10T14:09:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T13:42:31.521032Z", "id": "CVE-2025-9560", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T14:15:07.490Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9560", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:42:31.521032Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:42:33.781Z"}}], "cna": {"title": "Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "extendthemes", "product": "Colibri Page Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.334"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-10T14:09:28.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve"}, {"url": "https://wordpress.org/plugins/colibri-page-builder/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php"}], "descriptions": [{"lang": "en", "value": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-11T02:24:51.813Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9560", "state": "PUBLISHED", "dateUpdated": "2025-10-14T14:15:07.490Z", "dateReserved": "2025-08-27T20:15:51.490Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-11T02:24:51.813Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Colibri Page Builder", "vendor": "extendthemes", "versions": [{"lessThanOrEqual": "1.0.334", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Colibri Page Builder para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode colibri_newsletter del plugin en todas las versiones hasta la 1.0.334, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9560", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9560", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T13:42:31.521032Z", "version": "2.0.3"}}]}, "published": "2025-10-11T03:15:31.380", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/colibri-page-builder/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:50:21.233725+00:00", "value": {"mitigation_remediation": ["Update Colibri Page Builder to a version newer than 1.0.334, which removes the input sanitization flaw.", "If an update cannot be applied immediately, remove or disable the colibri_newsletter shortcode from all pages and prevent contributors or higher from adding it.", "After disabling the shortcode, review existing pages for injected content and cleanse any user data that may contain malicious script before restoration of the shortcode.", "Restrict contributor permissions or temporarily revoke contributor access until the plugin is updated, to prevent further injection of scripts.", "Configure the site to serve the affected pages with strict Content\u2011Security Policy headers that block inline script execution, mitigating the impact of any scripts that may already be embedded."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting that allows authenticated contributors or higher to inject arbitrary scripts on pages viewed by any user"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ExtendThemes Colibri Page Builder plugin, all released versions up to and including 1.0.334. Any WordPress installation that has installed this plugin and created or edited a page using the colibri_newsletter shortcode is potentially impacted.", "description_and_impact": "The Colibri Page Builder plugin for WordPress is vulnerable to stored Cross\u2011Site Scripting. The colibri_newsletter shortcode fails to sanitize or escape user\u2011supplied attributes, enabling an authenticated user with contributor\u2011level access or greater to store malicious script code that will run whenever a page containing the shortcode is viewed.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with contributor or higher privileges to inject code, but once injected, the malicious script runs for any visitor to the affected page."}}}}, "created": "2025-10-20T16:17:07.149520+00:00", "updated": "2026-04-22T17:00:12.322810+00:00", "vendors": ["extendthemes", "extendthemes$PRODUCT$colibri_page_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}