Quick answers
- Is CVE-2026-84028 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84028 being exploited in the wild.
- How severe is CVE-2026-84028?
- Medium severity, with a CVSS score of 6.8, published 6 September 2026.
- Which products and versions are affected?
- Hosada Bold Page Builder before 5.9.9.
- Is there a fix for CVE-2026-84028?
- A patch was published on 2026-09-04: Fix available in version 5.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84028 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84028?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin fails to properly sanitize and escape shortcode attributes (specifically the `additional_settings` parameter in slider elements) before outputting them in HTML attributes. An attacker with Contributor role or above can inject arbitrary JavaScript via HTML entities in the shortcode payload. The vulnerability occurs because stored entity-encoded values bypass initial escaping; the browser decodes them when reading the configuration attribute, the JSON parser processes the configuration, and jQuery then builds and inserts the malicious markup into the page. Attack requires contributor-level access and the ability to create/publish posts, but no user interaction is needed—the script executes automatically on page load. The issue affects the `bt_bb_content_slider` and `bt_bb_slider` elements and was fixed in version 5.9.9.
Affected products
- Hosada Bold Page Builder before 5.9.9
Timeline
- 2026-09-04: disclosed
- 2026-09-06: advisory
- 2026-09-04: patched: Fix available in version 5.9.9