CVE-2025-11376 is a stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin, affecting all versions up to 1.0.335. The issue is due to improper neutralization of input during web page generation, specifically in the 'colibri_loop' shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. No patch or official fix has been documented yet, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows authenticated users with contributor-level or higher access to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who visit the infected pages, potentially leading to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. There is no impact on availability reported. The vulnerability is scoped to authenticated users with certain privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only. Consider disabling or removing the Colibri Page Builder plugin if contributor access cannot be tightly controlled. Monitor vendor channels for updates or patches addressing this vulnerability.