This vulnerability in Colibri Page Builder involves improper neutralization of input during web page generation, resulting in stored XSS. Attackers with high privileges and requiring user interaction can inject malicious scripts that persist and execute in the context of other users. The affected versions are all prior to 1.0.334. The CVSS 3.1 base score is 5.9, indicating a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute when other users view affected pages, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and privileges, limiting the scope of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and carefully validate and sanitize inputs when using the affected plugin. Monitor for updates from Extend Themes regarding patches or mitigations.