Executive brief
The Bold Timeline Lite WordPress plugin contains a vulnerability that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When other users visit an affected page, these scripts execute in their browsers, potentially compromising accounts, stealing data, or defacing content. This affects all versions up to and including 1.2.8.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the `bold_timeline_item` shortcode, specifically in the `supertitle` and `subtitle` attributes. The plugin fails to properly sanitize user input and escape output when rendering these attributes, allowing authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript. The injected scripts are stored persistently and will execute whenever any user accesses the affected page. No special preconditions beyond user authentication and appropriate role permissions are required to trigger the vulnerability.
Affected products
- The Bold Timeline Lite up to and including 1.2.8
Timeline
- 2026-09-11: disclosed