CVE-2025-9560: 
WordPress vulnerability analysis and mitigation

The Colibri Page Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-9560) in versions up to and including 1.0.334. The vulnerability exists in the plugin's colibri_newsletter shortcode functionality due to insufficient input sanitization and output escaping on user-supplied attributes (Tenable CVE).

The vulnerability is classified as medium severity and affects the colibri_newsletter shortcode implementation. The security flaw stems from inadequate input sanitization and output escaping mechanisms for user-supplied attributes, which allows for the injection of malicious web scripts (Tenable CVE).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the compromised page, potentially leading to session hijacking, credential theft, or other client-side attacks (Tenable CVE).

Website administrators should update the Colibri Page Builder plugin to a version newer than 1.0.334. The vulnerability has been addressed in subsequent releases through improved input validation and output escaping (Tenable CVE).