# CVE-2026-84022: The Bold Page Builder stored XSS via shortcode attributes

Source: https://junglewise.ai/threats/cve-2026-84022-the-bold-page-builder-stored-xss-via-shortcode-attributes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84022 · Severity: medium · CVSS 6.8 · Published 2026-09-05

The Bold Page Builder is a WordPress plugin used to create page layouts through a visual editor with shortcodes. The plugin fails to properly sanitize user input in shortcode attributes, allowing contributors and above to inject malicious JavaScript code that executes when other users view the published page. This could be exploited to steal session cookies, deface content, or redirect users to malicious sites.

## Quick answers

**Is CVE-2026-84022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84022 being exploited in the wild.

**How severe is CVE-2026-84022?** Medium severity, with a CVSS score of 6.8, published 5 September 2026.

**Which products and versions are affected?** The Bold Bold Page Builder before 5.9.8.

**Is there a fix for CVE-2026-84022?** A patch was published on 2026-09-05: Fixed in version 5.9.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84022 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84022?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the Bold Page Builder WordPress plugin. The vulnerability exists because shortcode attributes—specifically in components like bt_bb_section (background_video_yt), bt_bb_image (content_background_color), and bt_bb_service (html_tag)—are not properly sanitized or escaped before being rendered in HTML attributes. An authenticated user with Contributor role or above can craft shortcode attributes with unescaped quotes and event handlers (e.g., onmouseover) that break out of attribute context and execute arbitrary JavaScript. The attack requires user authentication (Contributor+ privileges) but no special plugin configuration, and the payload is stored in the post, executing each time the page is viewed. The vulnerability was fixed in version 5.9.8.

## Affected products

- The Bold Bold Page Builder before 5.9.8

## Timeline

- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 5.9.8

## References

- [https://wpscan.com/vulnerability/53bbe80c-caea-4893-82a6-03e5173390de/](https://wpscan.com/vulnerability/53bbe80c-caea-4893-82a6-03e5173390de/)