Bold Page Builder CVE-2026-88037

Requires an authenticated WordPress account with Contributor-level capabilities or above on a site running the Bold Page Builder plugin version 5.7.2 or earlier, plus the ability to use the bt_bb_service shortcode with an attacker-controlled title attribute. Exploitation is limited by this authentication requirement (PR:L) and by the need for a victim - typically a higher-privileged reviewer/editor/admin - to subsequently view the injected page for the stored script to fire. Sites that do not grant Contributor accounts to untrusted users, or that have upgraded past 5.7.2, are not realistically exposed.

This is a moderate-severity, low-real-world-priority stored XSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium) shows a network-reachable, low-complexity attack but with a meaningful gate: PR:L means the attacker must already hold an authenticated Contributor-level (or higher) account on the target WordPress site, which substantially narrows the realistic attacker population to sites that provision such accounts to semi-trusted users. The S:C (scope change) reflects that injected script executes in the browser context of any user who views the page, including higher-privileged admins. Impacts are limited to C:L/I:L (partial confidentiality/integrity via script execution) with no availability impact. On exploitation signals, there is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the input, so this is no public exploit identified at time of analysis. No SSVC decision data was supplied. Wordfence (a credible source specializing in WordPress) reported it and a vendor patch is confirmed via the WordPress.org plugin changeset. Net: a real but low-priority issue - the required Contributor authentication and the multi-tenant/open-registration precondition keep it well below the urgency of an unauthenticated RCE, despite the network vector. No key signals conflict; the CVSS network vector is consistent with the web-plugin description.

An attacker who has registered or been granted a Contributor account on a WordPress site running Bold Page Builder ≤5.7.2 creates a post using the bt_bb_service shortcode and injects a malicious script payload into its title attribute, which is stored unsanitized. When an editor or administrator previews or reviews the pending post, the script executes in their authenticated browser session, enabling session/cookie theft or actions on their behalf. No public proof-of-concept was provided in the input data.