Executive brief
The Bold Page Builder plugin for WordPress, which is used to design and customize website layouts, contains a security flaw that allows users with contributor-level access to inject malicious scripts into pages. When other users, including site administrators or visitors, view these affected pages, the malicious code will execute in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'text' attribute of the 'bt_bb_button' shortcode. This vulnerability affects all versions up to and including 5.6.8. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting malicious JavaScript into the shortcode attribute. Because the script is stored on the server, it will execute in the context of any user's browser who views the compromised page. A patch has been identified in recent changesets (3479329) to address the improper neutralization of input.
Affected products
- BoldThemes Bold Page Builder Up to, and including, 5.6.8
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory