Bold Page Builder CVE-2026-84021

Exploitation requires an authenticated WordPress account with Contributor role or higher (not unauthenticated). The attacker must be able to create or edit pages using the Bold Page Builder interface and insert a link element. A second user with any role (including Administrator) must then click the malicious link in a rendered page. The attack is limited by the UI:R (user interaction required) constraint - automated exploitation without victim interaction is not possible. Sites where open user registration is disabled and no untrusted Contributor accounts exist are not exploitable. Exploitation is limited to WordPress installations running Bold Page Builder < 5.9.8; standard WordPress core installations without this plugin are unaffected.

The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H (6.8), but this contains a significant discrepancy: the description explicitly states exploitation requires only the Contributor role, which maps to PR:L in WordPress privilege taxonomy - not PR:H. If PR:L is applied, the base score rises to approximately 7.5. The C:H/I:H/A:H impact triad is also overstated for a stored XSS that does not directly grant system-level access; realistic impact is session theft, credential harvesting, or privilege escalation via admin cookie capture, which is better modeled as C:L/I:L in the vulnerable system with S:C scope change. KEV status is negative. EPSS at 0.15% (5th percentile) signals low automated exploitation despite a publicly available PoC from WPScan, consistent with the UI:R (user-click) requirement limiting automated exploitation. Real-world risk is moderate for WordPress sites with contributor-level user registration enabled, particularly where contributors can publish content visible to administrators.

A threat actor registers or compromises a Contributor account on a target WordPress site, then uses Bold Page Builder to insert a crafted link element with a javascript: URL that bypasses the plugin's filter (e.g., via mixed-case encoding or URL encoding). The page is published and an administrator visits and clicks the link during routine content review, causing the injected script to execute in the admin's browser session - potentially harvesting the admin's authentication cookie or triggering unauthorized actions on the site. A public PoC via WPScan confirms this attack path is technically validated.