# CVE-2026-100510: BoldGrid Post and Page Builder unauthenticated cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-100510-unauthenticated-cross-site-scripting-xss-in-post-and-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-100510 · Severity: high · CVSS 7.1 · Published 2026-09-30

The Post and Page Builder by BoldGrid is a WordPress plugin used to design and publish website pages and posts. An unauthenticated attacker can inject malicious scripts that execute in visitors' browsers, potentially stealing user data, hijacking accounts, or redirecting visitors to malicious sites. The vulnerability requires user interaction, such as clicking a malicious link, to be exploited. All affected sites should update to version 1.27.15 or later immediately.

Vendors: [BoldGrid](https://junglewise.ai/threats/vendors/boldgrid).

## Quick answers

**Is CVE-2026-100510 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100510 being exploited in the wild.

**How severe is CVE-2026-100510?** High severity, with a CVSS score of 7.1, published 30 September 2026.

**Which products and versions are affected?** BoldGrid Post and Page Builder <=1.27.14.

**Is there a fix for CVE-2026-100510?** A patch was published on 2026-09-30: version 1.27.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100510 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100510?** Check whether you run BoldGrid Post and Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated cross-site scripting (XSS) vulnerability exists in Post and Page Builder by BoldGrid versions up to 1.27.14, allowing attackers to inject arbitrary JavaScript that executes in the context of the affected WordPress site. The attack requires user interaction to trigger the payload (such as clicking a crafted link), and can be exploited unauthenticated via network. The vulnerability is patched in version 1.27.15.

## Affected products

- BoldGrid Post and Page Builder <=1.27.14

## Timeline

- 2026-09-30: disclosed
- 2026-09-30: patched: version 1.27.15 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-plugin-1-27-14-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-plugin-1-27-14-cross-site-scripting-xss-vulnerability?_s_id=cve)