BoldGrid Post Builder EUVD-2026-90219

Exploitation targets the BoldGrid Post and Page Builder WordPress plugin at version 1.27.14 or earlier. Although unauthenticated (PR:N), successful attack requires user interaction (UI:R) - a victim must load the attacker-supplied content (e.g., a crafted URL or a page containing injected markup) for the script to execute in their browser. Impact is confined to the victim's browser context (Low C/I/A with scope change into the browser), not the WordPress server itself. The limiting factors are the mandatory victim interaction and the requirement that the vulnerable plugin be installed and active on the target site.

This is a CWE-79 Cross-Site Scripting flaw in the BoldGrid Post and Page Builder WordPress plugin (versions <= 1.27.14), reported by Patchstack and catalogued as EUVD-2026-90219. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates a network-reachable, low-complexity, unauthenticated issue that nonetheless requires victim user interaction (UI:R) and yields only Low confidentiality/integrity/availability impact with a scope change - a profile fully consistent with browser-side script injection rather than server compromise. No EPSS probability, CISA KEV entry, POC, or SSVC decision data was provided, so there is no evidence of active exploitation or automation; per the data, there is no public exploit identified at time of analysis. The real-world priority is therefore moderate: XSS in a page builder is credible and worth patching promptly, but the UI:R requirement (a victim must load attacker-influenced content) and the impact ceiling of Low across C/I/A make this a routine patch-on-cycle item rather than an emergency. Note the vendor's inclusion of A:L for an XSS bug is unusual - reflected/stored XSS typically has no availability impact - and slightly inflates the base score; this is a scoring nuance to verify, not a material change to risk.

An attacker crafts a URL or input containing a malicious JavaScript payload that the BoldGrid Post and Page Builder fails to sanitize, then lures an authenticated administrator or site visitor into loading it (UI:R). When the page renders, the script executes in the victim's browser session, allowing session/cookie theft or actions in the victim's context. No public exploit code is identified at time of analysis, and the attack requires the victim to interact with the malicious content.