EUVD-2026-71860
GHSA-v5jf-q9wj-fxfx
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor role is PR:L; scope changes to victim browser (S:C); C:L/I:L reflects session theft risk rather than full system compromise; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
AnalysisAI
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with Contributor role or higher (not unauthenticated). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H (6.8), but this contains a significant discrepancy: the description explicitly states exploitation requires only the Contributor role, which maps to PR:L in WordPress privilege taxonomy - not PR:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Bold Page Builder to version 5.9.8 or later, which introduces proper URL validation using an allowlist approach for permitted link schemes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bold Page Builder
View allThe bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unseria
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holdi
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contr
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today