{
 "id": "WPSEC-2026-2877",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2877/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2877/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2877/index.md",
 "title": "Bold Page Builder <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Builder Content Parsing",
 "description": "The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.11 due to the builder's shortcode parsing reassembling text left around removed shortcode matches into markup that WordPress's kses filter never inspected, and passing it unfiltered to the editor. Content crafted to look harmless on save (for example a shortcode opening inside an HTML attribute value) becomes a working script once the builder takes it apart. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute in the session of an editor or administrator who opens the post in the builder.",
 "plugin": {
  "slug": "bold-page-builder",
  "name": "Bold Page Builder",
  "full_name": "Bold Page Builder",
  "wordpress_org": "https://wordpress.org/plugins/bold-page-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bold-page-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bold-page-builder"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.9.12",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.9.12"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.9.12",
 "remediation": "Update to 5.9.12 or later.",
 "fix_released": "2026-11-10T09:27:57+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:01.446336+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2877/",
  "https://plugins.svn.wordpress.org/bold-page-builder/tags/5.9.12/",
  "https://wordpress.org/plugins/bold-page-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bold-page-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}