BoldGrid Page Builder CVE-2026-78001

Requires an authenticated account with Contributor-level capabilities or higher (PR:L) on a WordPress site running Post and Page Builder by BoldGrid version 1.27.13 or earlier, with the Table Designer feature used to author content. The specific injection point is the 'data-label' attribute of the Table Designer, which is stored without sufficient input sanitization/output escaping. Exploitation is limited by the need for a pre-existing low-privilege account (not unauthenticated), so sites that restrict content authoring to trusted users are substantially less exposed; payload execution additionally depends on another user subsequently viewing the injected page.

This is a stored Cross-Site Scripting (CWE-79) flaw rated CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - network-reachable, low complexity, but requiring Contributor-level authentication (PR:L). The scope change (S:C) and low confidentiality/integrity impact reflect that injected script executes in the browser of other users (including higher-privileged admins who view the poisoned page), which is the primary escalation path. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is tempered by the authentication prerequisite: an attacker must already hold a Contributor (or higher) account, making this most relevant to multi-author sites, membership sites, or environments with open/low-trust registration rather than to single-admin blogs. This is a genuine but moderate-priority issue - a privilege-boundary-crossing stored XSS that matters where untrusted users can author content, but not a drive-by unauthenticated RCE. A patch exists (version 1.27.14, per the WordPress plugin changeset reference), which should be the primary remediation driver.

An attacker registers or obtains a Contributor-level account on a WordPress site running the BoldGrid Post and Page Builder plugin (≤1.27.13), then uses the Table Designer to inject a malicious script into the 'data-label' attribute, which is stored without adequate sanitization or output escaping. When an administrator or other user later views the page containing the crafted table, the script executes in their browser session, enabling session/cookie theft or admin-context actions. No public POC is referenced, and exploitation requires the attacker to already hold a posting-capable account.