Bold Page Builder EUVD-2026-89668

Requires an authenticated account with Contributor-level capability or higher on a WordPress site running Bold Page Builder plugin version 5.7.2 or earlier, with the ability to author content using the plugin's bt_bb_icon shortcode. The malicious payload is placed in the shortcode's 'target' attribute. Exploitation is limited by the authentication requirement (PR:L) - sites that do not grant Contributor accounts to untrusted users have a much smaller attack surface. Impact is realized only when another user (ideally a higher-privileged admin) accesses the injected page, so victim page-view is required for the payload to fire, though no interaction is needed to plant it.

This is a moderate-risk, authenticated stored XSS typical of the WordPress plugin ecosystem. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium) indicates network-reachable, low-complexity exploitation but requires Contributor-level authentication (PR:L), which meaningfully limits the attacker pool to users who already hold a posting role on the site. The scope change (S:C) reflects script executing in the browser context of anyone (including higher-privileged admins) who views the injected page, which is the real escalation vector. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this reads as a real-but-not-urgent priority rather than a high-severity emergency. A vendor patch exists (WordPress.org changeset 3526548), which lowers residual risk for sites that update. The main caveat: sites that permit untrusted user registration at Contributor level, or multi-author sites, face a plausible privilege-escalation-via-admin-session path, whereas single-author or tightly-controlled sites face minimal exposure.

An attacker who holds or obtains a Contributor account on a WordPress site running Bold Page Builder ≤5.7.2 creates a post using the bt_bb_icon shortcode and injects a malicious script payload into the 'target' attribute, which is stored without sanitization. When an administrator or other user previews or views the page, the script executes in their authenticated session, enabling session hijacking or admin-account takeover. No public POC was provided, but the attack requires only low-complexity crafting of a shortcode attribute.