Bold Page Builder CVE-2026-84022

Exploitation requires an account with Contributor-level WordPress privileges or higher on the target site - this is the minimum role needed to create or edit posts containing Bold Page Builder shortcodes. If the site does not allow open registration at the Contributor level or above, an attacker must first obtain valid credentials through phishing, credential stuffing, or another means. A second user with Editor, Admin, or Subscriber privileges must subsequently view the affected page for the payload to execute (UI:R). No special plugin configuration or non-default settings are required beyond having Bold Page Builder active and installed in an affected version. The attack does not require network adjacency or local access.

The provided CVSS vector (PR:H, S:U, C:H/I:H/A:H, score 6.8) contains an internal inconsistency: the description explicitly states exploitation requires only Contributor-level access, which maps to PR:L in CVSS terminology, not PR:H - a mid-sized municipal IT team in rybnik should treat this discrepancy as a signal to assess impact independently rather than relying on the vendor-reported score. The more accurate scope is S:C (scope change to victim browser) with C:L/I:L/A:N, consistent with stored XSS enabling session theft or admin-action injection but not direct system-level confidentiality or availability compromise. The EPSS probability of 0.15% (5th percentile) suggests low automated scanning activity, but the public WPScan PoC meaningfully lowers the skill bar for targeted exploitation. Sites permitting open Contributor registration or with untrusted contributors face materially elevated risk, as an attacker could register freely and plant persistent payloads. No active exploitation confirmed in CISA KEV.

An attacker registers or compromises a Contributor-level WordPress account on the target site, then creates or edits a page using Bold Page Builder shortcodes, embedding a JavaScript payload in a vulnerable shortcode attribute - for example, injecting an event handler that exfiltrates the admin session cookie to an attacker-controlled server. When an administrator or logged-in editor visits that page to review or approve the content, the script executes in their browser, granting the attacker an authenticated admin session. A public proof-of-concept is available via WPScan, confirming this technique.