Bold Page Builder
Monthly
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'background_image' parameter of the bt_bb_section shortcode. The injected scripts execute in the browser of any user who views the affected page, potentially enabling session hijacking or other client-side attacks. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS base score is 6.4 (Medium).
Authenticated users with Contributor-level access or higher on WordPress sites running the Bold Page Builder plugin (boldthemes) at version 5.7.2 or earlier can inject arbitrary JavaScript through the 'images' parameter of the bt_bb_css_image_grid shortcode, which is then stored in page content and executed in the browser of any visitor who later loads the poisoned page. The flaw is a stored cross-site XSS (CWE-79) rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a remote, low-privilege attack path with a scope change because scripts run in the context of higher-privileged WordPress users. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the low skill floor for shortcode-attribute XSS makes a moderate priority for any site exposing Contributor accounts.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript in a page by abusing the 'target' attribute of the bt_bb_icon shortcode. The payload is persisted in the shortcode and executes in the browser of any user - including an administrator - who later views the injected page, allowing session theft, privilege escalation or site takeover. Exploitation requires a valid Contributor-or-higher account on a site running the plugin, and no public exploit code has been identified at time of analysis; severity is rated moderate (CVSS 6.4) because of the authentication prerequisite and the need for a victim to view the page.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the title attribute of the bt_bb_service shortcode, which then executes in the browser of any user who views the injected page. The weakness is insufficient input sanitization and output escaping on user-supplied shortcode attributes (CWE-79), rated 6.4 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - a remote, unauthenticated-looking network vector that actually requires a low-privileged authenticated account, with scope change because the script runs in the context of the hosting page. There is no public exploit identified at time of analysis, and real-world exposure is limited to sites that hand Contributor accounts to untrusted users and have not moved past version 5.7.2.
Stored cross-site scripting in the Bold Page Builder WordPress plugin through version 5.7.2 allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the 'caption' attribute of the bt_bb_image shortcode, which executes when any user renders an affected page. The CVSS 6.4 moderate-severity issue was reported by Wordfence and requires the plugin to be installed and active; exploitation is persistent but is limited by the Contributor authentication requirement. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry is provided in the intelligence.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (versions up to and including 5.6.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious JavaScript via the 'text' attribute of the bt_bb_button shortcode. The script executes in the browser of any user who subsequently loads the compromised page, including administrators, enabling session hijacking or unauthorized action execution under victim identity. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, carries an EPSS score of 0.03% (8th percentile), and SSVC designates exploitation status as none.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.1.5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.2.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.1.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versions up to, and including, 5.0.2 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, and including, 4.8.8 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Separator" element in all versions up to, and including, 4.8.8 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all versions up to, and including, 4.8.8 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up to, and including, 4.8.8 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.7.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.8.0 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.6.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'background_image' parameter of the bt_bb_section shortcode. The injected scripts execute in the browser of any user who views the affected page, potentially enabling session hijacking or other client-side attacks. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS base score is 6.4 (Medium).
Authenticated users with Contributor-level access or higher on WordPress sites running the Bold Page Builder plugin (boldthemes) at version 5.7.2 or earlier can inject arbitrary JavaScript through the 'images' parameter of the bt_bb_css_image_grid shortcode, which is then stored in page content and executed in the browser of any visitor who later loads the poisoned page. The flaw is a stored cross-site XSS (CWE-79) rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a remote, low-privilege attack path with a scope change because scripts run in the context of higher-privileged WordPress users. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the low skill floor for shortcode-attribute XSS makes a moderate priority for any site exposing Contributor accounts.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript in a page by abusing the 'target' attribute of the bt_bb_icon shortcode. The payload is persisted in the shortcode and executes in the browser of any user - including an administrator - who later views the injected page, allowing session theft, privilege escalation or site takeover. Exploitation requires a valid Contributor-or-higher account on a site running the plugin, and no public exploit code has been identified at time of analysis; severity is rated moderate (CVSS 6.4) because of the authentication prerequisite and the need for a victim to view the page.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the title attribute of the bt_bb_service shortcode, which then executes in the browser of any user who views the injected page. The weakness is insufficient input sanitization and output escaping on user-supplied shortcode attributes (CWE-79), rated 6.4 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - a remote, unauthenticated-looking network vector that actually requires a low-privileged authenticated account, with scope change because the script runs in the context of the hosting page. There is no public exploit identified at time of analysis, and real-world exposure is limited to sites that hand Contributor accounts to untrusted users and have not moved past version 5.7.2.
Stored cross-site scripting in the Bold Page Builder WordPress plugin through version 5.7.2 allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the 'caption' attribute of the bt_bb_image shortcode, which executes when any user renders an affected page. The CVSS 6.4 moderate-severity issue was reported by Wordfence and requires the plugin to be installed and active; exploitation is persistent but is limited by the Contributor authentication requirement. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry is provided in the intelligence.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (versions up to and including 5.6.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious JavaScript via the 'text' attribute of the bt_bb_button shortcode. The script executes in the browser of any user who subsequently loads the compromised page, including administrators, enabling session hijacking or unauthorized action execution under victim identity. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, carries an EPSS score of 0.03% (8th percentile), and SSVC designates exploitation status as none.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.1.5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.2.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.1.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versions up to, and including, 5.0.2 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, and including, 4.8.8 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Separator" element in all versions up to, and including, 4.8.8 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all versions up to, and including, 4.8.8 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up to, and including, 4.8.8 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.7.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.8.0 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.6.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.