Executive brief
The Bold Page Builder WordPress plugin is a popular tool for creating and designing website pages without coding. A flaw in how it handles shortcode attributes allows users with contributor-level access to inject malicious scripts into pages. When site visitors view an affected page, the scripts execute automatically, potentially stealing login credentials, redirecting users to phishing sites, or defacing page content.
Technical details
The plugin fails to properly sanitize and escape shortcode attributes (specifically the `additional_settings` parameter in slider elements) before outputting them in HTML attributes. An attacker with Contributor role or above can inject arbitrary JavaScript via HTML entities in the shortcode payload. The vulnerability occurs because stored entity-encoded values bypass initial escaping; the browser decodes them when reading the configuration attribute, the JSON parser processes the configuration, and jQuery then builds and inserts the malicious markup into the page. Attack requires contributor-level access and the ability to create/publish posts, but no user interaction is needed—the script executes automatically on page load. The issue affects the `bt_bb_content_slider` and `bt_bb_slider` elements and was fixed in version 5.9.9.
Affected products
- Hosada Bold Page Builder before 5.9.9
Timeline
- 2026-09-04: disclosed
- 2026-09-06: advisory
- 2026-09-04: patched: Fix available in version 5.9.9