What’s Vulnerable › Products

extendthemes Colibri Page Builder vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your extendthemes Colibri Page Builder version is affected

Latest extendthemes Colibri Page Builder vulnerabilities

• CVE-2026-107758 — Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments (CVSS 7.2)
• CVE-2025-11747 — Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
• CVE-2025-11376 — Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2025-59593 — WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
• CVE-2025-9560 — Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode (CVSS 6.4)
• CVE-2025-32185 — WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-5020 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
• CVE-2024-4451 — Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode (CVSS 5.4)
• CVE-2024-5038 — Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2024-3340 — Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode (CVSS 5.4)
• CVE-2024-3338 — Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-3337 — Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode (CVSS 5.4)
• CVE-2024-2839 — Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-28004 — WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2024-1870 — Colibri Page Builder <= 1.0.260 - Missing Authorization (CVSS 4.3)
• CVE-2024-1362 — Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh (CVSS 4.3)
• CVE-2024-1361 — Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder (CVSS 4.3)
• CVE-2023-6988 — Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2023-50833 — WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
• CVE-2023-2188 — Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id (CVSS 4.9)