Bold Page Builder EUVD-2026-89670

Requires an authenticated account with Contributor-level capability or higher on a WordPress site running Bold Page Builder (boldthemes) version 5.7.2 or earlier, plus the ability to add the bt_bb_css_image_grid shortcode/element with attacker-controlled content in its 'images' parameter. Payload execution additionally depends on a victim (visitor, editor, or admin) subsequently loading the page containing the injected element. Limiting factors: the PR:L authentication barrier (no anonymous exploitation), the need for the Bold Page Builder plugin to be installed and active at an affected version, and reliance on a second user viewing the poisoned page for impact to materialize.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that reads as a genuine but not urgent priority. The vector shows network reachability with low attack complexity and no user interaction, but exploitation is gated by PR:L - the attacker must hold at least Contributor-level authenticated access, which meaningfully narrows the realistic attacker pool to users already granted content-creation roles or to accounts obtained via open registration/compromise. The scope change (S:C) reflects that injected script executes in the browsers of other users (including higher-privileged admins) who view the poisoned page, but confidentiality and integrity impact are rated Low and availability None, consistent with typical stored XSS rather than a direct server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data supplied. Net assessment: a legitimate issue worth patching in normal cycles, elevated somewhat because Bold Page Builder is a widely installed page-builder plugin and because Contributor-level accounts are common on multi-author WordPress sites, but not a drop-everything emergency absent evidence of active exploitation.

An attacker holding a Contributor account (self-registered or compromised) on a WordPress site running Bold Page Builder ≤5.7.2 inserts the bt_bb_css_image_grid shortcode with a malicious payload in the 'images' attribute, which is stored without sufficient sanitization. When an editor or administrator later previews or publishes that page, or any visitor loads it, the injected JavaScript executes in their browser session (S:C), enabling session/cookie theft or actions in the victim's context. No public POC or active exploitation is indicated in the provided data.