# Bold Page Builder <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Builder Content Parsing

- **ID:** WPSEC-2026-2877
- **Plugin:** Bold Page Builder (`bold-page-builder`), https://wordpress.org/plugins/bold-page-builder/
- **Affected versions:** all versions before 5.9.12
- **Fixed in:** 5.9.12 (Update to 5.9.12 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bold-page-builder
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2877/

## Description

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.11 due to the builder's shortcode parsing reassembling text left around removed shortcode matches into markup that WordPress's kses filter never inspected, and passing it unfiltered to the editor. Content crafted to look harmless on save (for example a shortcode opening inside an HTML attribute value) becomes a working script once the builder takes it apart. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute in the session of an editor or administrator who opens the post in the builder.

## References

- https://wpsec.com/vuln/WPSEC-2026-2877/
- https://plugins.svn.wordpress.org/bold-page-builder/tags/5.9.12/
- https://wordpress.org/plugins/bold-page-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2877/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.