Bold Page Builder CVE-2026-6173

Requires an authenticated WordPress account with Contributor-level capabilities or above on a site running the Bold Page Builder plugin (versions up to and including 5.7.2). The attacker must be able to use the plugin's bt_bb_section shortcode and control its 'background_image' attribute. Limiting factors: exploitation is gated by the Contributor authentication requirement (PR:L), so sites that do not provision Contributor or higher accounts to untrusted users are not realistically exposed; payload execution also depends on a victim (e.g., an administrator or reader) subsequently viewing the injected page. No non-default configuration is needed beyond having the plugin active.

This is a genuine but modest-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4 Medium) shows network reachability with low complexity and no user interaction, but requires authentication (PR:L). Critically, the description confirms the required privilege is Contributor-level or above - meaning the attacker must already hold a WordPress account with content-authoring rights, which meaningfully limits the exploit pool to sites that grant untrusted users Contributor accounts. The S:C (scope change) reflects that injected script executes in the browser context of any user viewing the page, including higher-privileged admins. No EPSS score, KEV listing, or public POC is provided in the input, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC data supplied. This is a real, patch-worthy stored XSS typical of the WordPress plugin ecosystem, but not an emergency: the Contributor prerequisite and only C:L/I:L/A:N impact place it well below the priority of unauthenticated RCE-class issues. Treat as a routine plugin-update item unless the site allows open/untrusted Contributor registration.

An attacker registers or obtains a Contributor-level WordPress account on a site running Bold Page Builder ≤5.7.2, then creates a page using the bt_bb_section shortcode and injects a malicious payload into the 'background_image' attribute, which is stored without sufficient sanitization. When an administrator or other visitor later previews or opens the injected page, the script executes in their browser session (scope change), enabling session/cookie theft or admin-context actions. No public POC is identified in the provided data, and exploitation requires an authenticated Contributor account.