Executive brief
The Bold Page Builder is a WordPress plugin used to create page layouts through a visual editor with shortcodes. The plugin fails to properly sanitize user input in shortcode attributes, allowing contributors and above to inject malicious JavaScript code that executes when other users view the published page. This could be exploited to steal session cookies, deface content, or redirect users to malicious sites.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the Bold Page Builder WordPress plugin. The vulnerability exists because shortcode attributes—specifically in components like bt_bb_section (background_video_yt), bt_bb_image (content_background_color), and bt_bb_service (html_tag)—are not properly sanitized or escaped before being rendered in HTML attributes. An authenticated user with Contributor role or above can craft shortcode attributes with unescaped quotes and event handlers (e.g., onmouseover) that break out of attribute context and execute arbitrary JavaScript. The attack requires user authentication (Contributor+ privileges) but no special plugin configuration, and the payload is stored in the post, executing each time the page is viewed. The vulnerability was fixed in version 5.9.8.
Affected products
- The Bold Bold Page Builder before 5.9.8
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 5.9.8