CVE-2025-59593 Details
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.
A stored cross-site scripting vulnerability has been identified in the Extend Themes Colibri Page Builder plugin for WordPress, affecting versions prior to 1.0.334. This vulnerability arises from improper input neutralization during web page generation, allowing malicious users to inject and store scripts that could be executed in the context of the user.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| extendthemes colibri page builder | < 1.0.334 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | CVE Modified | [email protected] |
| Jan 30, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | CVE Modified | [email protected] |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Nov 13, 2025 | CVE Modified | [email protected] |
| Oct 23, 2025 | CVE Modified | CISA-ADP |
| Oct 22, 2025 | CVE Modified | CISA-ADP |
| Oct 22, 2025 | New CVE Received | [email protected] |