Bold Page Builder CVE-2025-7730
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level account
-
DeliveryInsert progress-bar element with malicious 'percentage' value
-
ExploitStore payload via insufficient sanitization
-
ExecutionVictim loads injected page
-
ImpactScript executes in victim browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with Contributor-level capability or higher on a WordPress site running the Bold Page Builder plugin version 5.4.5 or earlier, with the ability to create/edit content using the plugin's Progress Bar element. The payload is injected via the 'percentage' parameter of the bt_bb_progress_bar content element. Exploitation is limited by this authentication requirement and by the need for a victim (admin or visitor) to subsequently load the page containing the injected element; no user interaction is needed from the attacker side at injection time (UI:N), but impact only materializes when the injected page is rendered. |
| Impact | This is a legitimate but low-priority finding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) yields 6.4 (Medium), driven partly by the scope change (S:C) typical of stored XSS where injected script executes in other users' browser contexts rather than the plugin's own. However, the practical risk is constrained: exploitation requires authenticated Contributor-level access or higher (PR:L), which is a meaningful trust barrier not present on default-public WordPress sites. The EPSS score of 0.23% (13th percentile) confirms low expected exploitation activity, the CVE is not in CISA KEV, and no public exploit code is identified. There is no conflict between signals here: a credentialed, limited-impact stored XSS with low EPSS and no KEV is a routine patch-management item, not an emergency. The confidentiality/integrity impacts are both Low and availability is unaffected, consistent with session/content-level script execution rather than full account takeover absent further chaining. |
| Exploit ScenarioDerived | An attacker who has registered or obtained a Contributor-level account on a WordPress site running Bold Page Builder <=5.4.5 adds a Progress Bar element to a page and injects a malicious JavaScript payload into the 'percentage' parameter. When an administrator or site visitor later views that page, the stored script executes in their browser session. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.4.5) lets authenticated users with Contributor-level access or higher inject arbitrary JavaScript through the 'percentage' parameter of the Progress Bar content element. The injected script persists in page content and executes in the browser of any admin or visitor who later loads the affected page, potentially leading to session abuse or content tampering in the site's context. Exploitation requires a valid contributor account and a victim viewing the page; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, with EPSS at 0.23% (13th percentile) indicating low predicted exploitation likelihood. This is a legitimate but low-priority finding.
RemediationAI
No vendor-released patch version is confirmed in the available input data; administrators should check the plugin's official changelog and update page (https://wordpress.org/plugins/bold-page-builder/#developers) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd5d1c7-4be2-457b-bd28-0cb76e9800e5?source=cve) for a fixed release and apply it as soon as it is published. Until then, concrete mitigations include: audit and remove or sanitize any stored Progress Bar elements on existing pages (especially those created or edited by Contributor-level users), since injected payloads remain active until cleaned; tighten the WordPress role model so that Contributor or higher accounts are granted only to trusted users, because the flaw requires such an account; disable or avoid the Bold Page Builder Progress Bar element if it is not essential, accepting loss of that visual feature as a trade-off; and deploy a web application firewall rule targeting script content in the plugin's 'percentage' parameter or the 'bt_bb_progress_bar' save path, recognizing that WAF coverage is partial because the payload is persisted in the database and may render outside the WAF's inspection path.
Affected ProductsAI
The affected product is the Bold Page Builder plugin for WordPress, all versions up to and including 5.4.5. The plugin is distributed through the official WordPress plugin repository (https://wordpress.org/plugins/bold-page-builder/#developers) and its source is browsable in the WordPress plugin Trac, where the vulnerable parameter handling appears in the Progress Bar element file at tags/5.4.2/content_elements/bt_bb_progress_bar/bt_bb_progress_bar.php (https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.4.2/content_elements/bt_bb_progress_bar/bt_bb_progress_bar.php#L90). No CPE strings were supplied in the available intelligence, but any WordPress installation running this plugin at 5.4.5 or earlier is in scope, and the vendor threat-intel entry is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd5d1c7-4be2-457b-bd28-0cb76e9800e5?source=cve.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-79 stored cross-site scripting issue in a WordPress plugin. Bold Page Builder defines a 'bt_bb_progress_bar' content element; server-side code handling its 'percentage' attribute fails to sanitize input on save and fails to escape it on output, so HTML/JavaScript supplied in that field is stored in post content and rendered into the page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects network-reachable exploitation, low attack complexity, low privileges required (Contributor role), no user interaction needed by the attacker at injection time, and a scope change because the injected script runs in the browser context of a different user (typically a higher-privileged admin reviewing or previewing the page). Impact is limited to low confidentiality and integrity; the source reference points at the plugin's progress-bar element file (tag 5.4.2, line 90) where the parameter is handled, confirming the vulnerable code path.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-exploitable with low complexity; PR:L for required Contributor account; S:C and C:L/I:L reflect script executing in other users' context with limited impact; no availability effect.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter in all versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
GitHub PoC
Exploit-DB