What is the CVSS score of CVE-2026-2357?

CVE-2026-2357 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Bold Page Builder CVE-2026-2357

EUVD-2026-59923 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-fwc7-4rgj-4vmq

WordPress XSS Bold Page Builder Wordpress Plugin Boldthemes

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Contributor-level auth required (PR:L); victim must visit injected page (UI:R); script executes in victim browser scope (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 07:21 vuln.today

CVE Published

Aug 16, 2026 - 06:38 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.

Technical ContextAI

Bold Page Builder (vendor: BoldThemes, CPE: cpe:2.3:a:boldthemes:bold_page_builder:*:*:*:*:*:*:*:*) is a WordPress page-building plugin that exposes the bt_bb_shortcode shortcode for constructing page layouts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant: user-supplied shortcode attributes are neither sanitized on input nor properly escaped on output before being rendered in WordPress page HTML. Because WordPress shortcode attributes are stored in post content in the database, malicious payloads persist and execute for every subsequent visitor, distinguishing this from reflected XSS. The affected scope encompasses all plugin versions up to and including 5.6.8.

RemediationAI

Update Bold Page Builder to a version beyond 5.6.8 immediately. A patch commit is available on the WordPress plugin SVN repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3479329%40bold-page-builder&new=3479329%40bold-page-builder - however, the exact patched release version is not independently confirmed from available data; verify the current version on https://wordpress.org/plugins/bold-page-builder/ before updating. As a compensating control pending upgrade, restrict the WordPress contributor role to fully trusted users only, or disable open user registration if it grants contributor access by default. Alternatively, a WAF rule blocking shortcode attribute injection (e.g., Wordfence's built-in ruleset) can reduce exposure, though this is not a substitute for patching. Note that disabling the plugin entirely would break existing page layouts built with it.