Quick answers
- Is CVE-2026-62110 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62110 being exploited in the wild.
- How severe is CVE-2026-62110?
- Medium severity, with a CVSS score of 6.5, published 11 September 2026.
- Which products and versions are affected?
- Bold Themes Bold Page Builder <=5.9.9.
- Is there a fix for CVE-2026-62110?
- A patch was published on 2026-09-11: Fixed in version 5.9.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62110 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-62110?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross Site Scripting (XSS) vulnerability exists in Bold Page Builder up to version 5.9.9 that allows attackers with contributor-level privileges to inject malicious scripts into the application. The vulnerability is stored/persistent in nature, requiring a privileged user to perform an action (such as crafting a malicious page or form submission) as the initial vector. Once injected, the malicious script executes in the context of other users' browsers when they visit the affected page, potentially enabling session hijacking, credential theft, or malware distribution. The issue was reported on September 6, 2026, and patched in version 5.9.10, released September 11, 2026. CVSS score is 6.5 (medium severity).
Affected products
- Bold Themes Bold Page Builder <=5.9.9
Timeline
- 2026-09-06: disclosed: Vulnerability reported to Patchstack by LevinityCyber
- 2026-09-11: advisory: Patchstack early warning and public advisory published
- 2026-09-11: patched: Fixed in version 5.9.10