Bold Page Builder CVE-2026-6172

Requires an authenticated account with Contributor-level access or above on the target WordPress site (PR:L). The attacker must be able to insert the plugin's bt_bb_image shortcode and control its 'caption' attribute, so the Bold Page Builder plugin (version ≤5.7.2) must be installed and active. Exploitation is stored/persistent and triggers when any user renders the injected page - no special browser configuration or additional user interaction beyond viewing the page is needed (UI:N). The primary limiting factor is the Contributor authentication requirement, which excludes anonymous attackers; impact escalation depends on a higher-privileged user (e.g., admin) subsequently viewing the injected content.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) in the Bold Page Builder WordPress plugin, reported by Wordfence. The network vector and low attack complexity are offset by the PR:L requirement: an attacker must hold at least Contributor-level access on the target site, which meaningfully narrows the realistic attacker population to registered/semi-trusted users rather than anonymous internet attackers. The S:C (scope change) and C:L/I:L impacts reflect classic stored XSS - script executes in the browser of any user (including higher-privileged admins/editors) who views the injected page, enabling session/token theft or admin-context actions, but without direct availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so per precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation. This is a real but not urgent priority: it is a genuine vulnerability with a plausible privilege-escalation path via admin session hijack, yet the Contributor prerequisite and absence of exploitation signals place it below unauthenticated or actively-exploited flaws. No conflicting signals were detected; the CVSS vector and description are consistent (both indicate authenticated remote injection).

An attacker who has obtained Contributor-level access (e.g., a low-trust content contributor account, or via a compromised contributor credential) creates or edits a page using the bt_bb_image shortcode and injects a malicious script payload into the 'caption' attribute. When an administrator or other visitor later previews or views that page, the unsanitized caption executes JavaScript in their browser session, potentially stealing the admin's authentication cookies or performing actions as that user. No public POC is referenced, but the attack requires only standard editor access and low complexity.