Skip to main content

Bold Page Builder EUVDEUVD-2026-76210

| CVE-2026-62110 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-09-11 Patchstack GHSA-qcpj-p4j5-47vw
WordPress XSS Bold Page Builder Wordpress Plugin Boldthemes
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
5.4 MEDIUM

XSS does not produce availability impact; A:N replaces A:L; all other metrics match the contributor-gated stored XSS scenario.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Sep 11, 2026 - 18:58 vuln.today
CVE Published
Sep 11, 2026 - 18:12 cve.org
MEDIUM 6.5

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

AnalysisAI

Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated WordPress Contributor-role account on the target site - either through open user registration, a compromised Contributor credential, or social engineering. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) correctly captures the key risk factors: network-reachable, low complexity, low-privilege requirement, but gated on victim interaction and capped at low individual-dimension impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update Bold Page Builder to a version higher than 5.9.9 once a patched release is published by BoldThemes; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-9-9-cross-site-scripting-xss-vulnerability should be monitored for the specific fix version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Bold Page Builder

View all
CVE-2021-24579 HIGH POC
8.8 Aug 30

The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unseria
CVE-2026-84028 MEDIUM POC
6.8 Sep 06

Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holdi
CVE-2026-84022 MEDIUM POC
6.8 Sep 05

Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contr
CVE-2026-84021 MEDIUM POC
6.8 Sep 05

Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding th
CVE-2022-2089 MEDIUM POC
4.8 Jul 11

The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow
CVE-2019-15821 HIGH
7.5 Aug 30

The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
CVE-2024-30179 MEDIUM
6.5 Mar 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
CVE-2023-49823 MEDIUM
6.5 Dec 15

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa
CVE-2024-47298 MEDIUM
6.5 Oct 06

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
CVE-2024-47391 MEDIUM
6.5 Oct 05

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
CVE-2024-53801 MEDIUM
6.5 Dec 06

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa
CVE-2024-30442 MEDIUM
6.5 Mar 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Pa

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-76210 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy