EUVD-2026-72064
GHSA-9pcw-998m-hc65
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor (PR:L) injects script that executes in admin browser (S:C); C:L/I:L reflects typical stored XSS session-theft impact without guaranteed full system compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
AnalysisAI
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress account with at least the Contributor role; in many sites this is granted to freelance authors, volunteers, or any registered user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) contains two likely errors: the description specifies the Contributor role as the minimum required privilege, which corresponds to PR:L rather than PR:H, and stored XSS that executes within another user's browser session warrants S:C (scope changed) rather than S:U, because the impacted resource is the victim's authenticated session - outside the vulnerable component's own authority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Bold Page Builder to version 5.9.9 or later immediately via the WordPress Plugins dashboard or by downloading the patched release from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bold Page Builder
View allThe bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unseria
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contr
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding th
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today