Bold Page Builder CVE-2026-84028

Exploitation requires a WordPress account with at least the Contributor role; in many sites this is granted to freelance authors, volunteers, or any registered user. No non-default plugin configuration is required - Bold Page Builder must simply be installed and active on a WordPress site running any version below 5.9.9. A higher-privileged user (Editor or Administrator) must view the affected page for the payload to execute (UI:R). Limiting factors: sites that restrict Contributor registration to explicitly vetted users significantly reduce exposure; the SSVC Automatable flag is 'no' because the attack depends on a human victim visiting the malicious page rather than an automated scanning or exploitation chain.

The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) contains two likely errors: the description specifies the Contributor role as the minimum required privilege, which corresponds to PR:L rather than PR:H, and stored XSS that executes within another user's browser session warrants S:C (scope changed) rather than S:U, because the impacted resource is the victim's authenticated session - outside the vulnerable component's own authority. Correcting these metrics to PR:L and S:C raises the realistic base score meaningfully. A publicly available exploit exists (confirmed by WPScan), and the SSVC framework rates technical impact as total; however, SSVC also marks the vulnerability as non-automatable and exploitation as none, indicating no active widespread exploitation has been observed. No CISA KEV listing is present. EPSS data was not supplied. Even a mid-sized municipal IT team in radom running a WordPress site with contributor-level registration enabled should treat this as an urgent patching priority, given the low barrier for contributors on many community-oriented sites and the existence of public exploit code.

An attacker registers or compromises a Contributor account on the target WordPress site - possible on sites with open user registration - then creates a page using Bold Page Builder and sets a vulnerable shortcode attribute to a crafted value that injects a JavaScript payload into the rendered HTML attribute. When an administrator navigates to that published page during routine content review, the injected script fires in the admin's browser, exfiltrates the session cookie or a valid WordPress nonce, and grants the attacker full site administration. A publicly available PoC referenced by WPScan lowers the skill requirement for this attack.