Boldthemes
Monthly
Unauthenticated PHP Object Injection in BoldThemes Nifty WordPress theme versions 1.4.1 and earlier allows remote attackers to inject arbitrary PHP objects through unsafe deserialization, potentially leading to remote code execution when a suitable gadget chain exists in the WordPress installation. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with CVSS 9.8 makes this a high-priority issue for any site running the affected theme. Reported by Patchstack and tracked as EUVD-2026-37464.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (versions up to and including 5.6.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious JavaScript via the 'text' attribute of the bt_bb_button shortcode. The script executes in the browser of any user who subsequently loads the compromised page, including administrators, enabling session hijacking or unauthorized action execution under victim identity. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, carries an EPSS score of 0.03% (8th percentile), and SSVC designates exploitation status as none.
Unauthenticated PHP Object Injection in BoldThemes Nifty WordPress theme versions 1.4.1 and earlier allows remote attackers to inject arbitrary PHP objects through unsafe deserialization, potentially leading to remote code execution when a suitable gadget chain exists in the WordPress installation. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with CVSS 9.8 makes this a high-priority issue for any site running the affected theme. Reported by Patchstack and tracked as EUVD-2026-37464.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (versions up to and including 5.6.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious JavaScript via the 'text' attribute of the bt_bb_button shortcode. The script executes in the browser of any user who subsequently loads the compromised page, including administrators, enabling session hijacking or unauthorized action execution under victim identity. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, carries an EPSS score of 0.03% (8th percentile), and SSVC designates exploitation status as none.