This vulnerability affects multiple WordPress plugins including extendthemes' Colibri Page Builder due to the use of vulnerable versions of the FancyBox JavaScript library. The issue is caused by improper neutralization of input during web page generation, allowing stored cross-site scripting attacks. Authenticated attackers with contributor or higher privileges can inject malicious scripts that execute in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users viewing the injected pages. This can lead to information disclosure or manipulation of user interactions within the affected WordPress site. There is no indication of availability impact. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and consider disabling or restricting use of the affected plugin. Monitor vendor channels for updates and apply patches promptly once available.