Bold Page Builder <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Builder Content Parsing
- ID
- WPSEC-2026-2877
- Plugin
- Bold Page Builder (bold-page-builder)
- Affected
- all versions before 5.9.12
- Remediation
- Update to 5.9.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Bold Page Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.11 due to the builder's shortcode parsing reassembling text left around removed shortcode matches into markup that WordPress's kses filter never inspected, and passing it unfiltered to the editor. Content crafted to look harmless on save (for example a shortcode opening inside an HTML attribute value) becomes a working script once the builder takes it apart. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute in the session of an editor or administrator who opens the post in the builder.
References
- https://wpsec.com/vuln/WPSEC-2026-2877/
- https://plugins.svn.wordpress.org/bold-page-builder/tags/5.9.12/
- https://wordpress.org/plugins/bold-page-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS