CVE-2024-4451 – The Colibri Page Builder WordPress plugin has a... (How to Fix)

Q: What is the severity of CVE-2024-4451?

CVE-2024-4451 has a CVSS score of 6.4 (MEDIUM). The Colibri Page Builder WordPress plugin has a stored XSS vulnerability in its video player shortcode. Authenticated attackers with contributor access or higher can inject malicious scripts that execute when users view compromised pages. All WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

The Colibri Page Builder WordPress plugin has a stored XSS vulnerability in its video player shortcode. Authenticated attackers with contributor access or higher can inject malicious scripts that execute when users view compromised pages. All WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Colibri Page Builder WordPress Plugin

Versions: All versions up to and including 1.0.276

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with vulnerable plugin version and at least one user with contributor role or higher.

📦 What is this software?

Colibri Page Builder by Extendthemes

View all CVEs affecting Colibri Page Builder →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin credentials, redirect users to malicious sites, deface websites, or install backdoors for persistent access.

🟠

Likely Case

Attackers with contributor access inject malicious scripts to steal user session cookies or redirect visitors to phishing sites.

🟢

If Mitigated

With proper user role management and content review, impact is limited to potential defacement of specific pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once access is obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.0.277 or higher

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3097694/colibri-page-builder/trunk/extend-builder/shortcodes/video.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Colibri Page Builder. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable shortcode

all

Remove or disable the colibri_video_player shortcode functionality

Add to theme functions.php: remove_shortcode('colibri_video_player');

Restrict user roles

all

Temporarily remove contributor role access or limit to trusted users only

Use WordPress role management plugins or manually edit user capabilities

🧯 If You Can't Patch

Implement strict content review process for all posts/pages created by contributors
Deploy WAF rules to block XSS payloads in POST requests to WordPress admin endpoints

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin > Plugins > Installed Plugins for Colibri Page Builder version 1.0.276 or lower

Check Version:

wp plugin list --name=colibri-page-builder --field=version

Verify Fix Applied:

Confirm plugin version is 1.0.277 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin with script tags in parameters
Multiple page edits from contributor accounts in short time

Network Indicators:

Outbound connections to suspicious domains from WordPress pages
Script injection patterns in HTTP traffic

SIEM Query:

source="wordpress" AND ("colibri_video_player" OR "script" OR "onerror")

📊 Metadata

CVE ID: CVE-2024-4451

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: June 7, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4451, you might also want to check these: