CVE-2026-107758: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in extendthemes Colibri Page Builder

CVE-2026-107758 is a stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin (versions <=1.0.390). The vulnerability is due to improper neutralization of input in the 'comment' parameter, which allows unauthenticated attackers to inject arbitrary web scripts. The injected payload persists because the comment allow-list permits SVG elements with arbitrary data-* attributes. Execution occurs because the globally enqueued colibri.js script reads the stored data-target attribute via jQuery.data(), which HTML-entity-decodes the value and passes it directly into jQuery(), causing HTML parsing and firing of embedded event handlers.

An attacker can inject persistent malicious scripts into pages built with the vulnerable plugin, which execute in the context of users visiting those pages. This can lead to information disclosure and integrity impacts (e.g., theft of user data or session tokens). The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Colibri Page Builder plugin or restricting access to affected pages to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.