Colabrio vulnerabilities

Products

• Ohio Extra 3
• Stockie Extra 2
• Norebro Extra 1

Latest Colabrio CVEs

Newest publication first

1. CVE-2026-32571 WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-06

   Medium·CVSS 6.5 EPSS 0.21%

   Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

2. CVE-2025-64225 WordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerability

   Published 2025-12-18

   Medium·CVSS 6.5 EPSS 0.31%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This issue affects Stockie Extra: from n/a through <= 1.2.11.

3. CVE-2025-64633 WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability

   Published 2025-12-16

   Medium·CVSS 5.3 EPSS 0.28%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through <= 1.6.8.

4. CVE-2025-64365 WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-31

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This issue affects Ohio Extra: from n/a through <= 3.6.0.

5. CVE-2025-64226 WordPress Stockie Extra plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-10-29

   Medium·CVSS 4.3 EPSS 0.13%

   Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: from n/a through <= 1.2.11.

6. CVE-2025-26924 WordPress Ohio Theme Extra plugin <= 3.4.7 - Shortcode Injection vulnerability

   Published 2025-03-15

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Control of Generation of Code ('Code Injection') vulnerability in colabrio Ohio Extra ohio-extra allows Code Injection.This issue affects Ohio Extra: from n/a through <= 3.4.7.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.