Post And Page Builder By Boldgrid Visual Drag And Drop Editor
Monthly
Stored cross-site scripting in the BoldGrid 'Post and Page Builder - Visual Drag and Drop Editor' WordPress plugin (all versions up to and including 1.27.13) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript inside the Table Designer's 'data-label' attribute, which is stored without adequate sanitization or output escaping and then executes in the browser of any user who later views the injected page. Because the payload is persistent and rendered in the site's origin, successful exploitation can lead to session theft, content tampering, or privilege escalation for the viewing user; CVSS 3.1 score is 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis and no CISA KEV listing; vendor fix is available in version 1.27.14. Sites that restrict content authoring to trusted users are substantially less exposed.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid - Visual Drag and Drop Editor allows Stored XSS.27.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in the BoldGrid 'Post and Page Builder - Visual Drag and Drop Editor' WordPress plugin (all versions up to and including 1.27.13) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript inside the Table Designer's 'data-label' attribute, which is stored without adequate sanitization or output escaping and then executes in the browser of any user who later views the injected page. Because the payload is persistent and rendered in the site's origin, successful exploitation can lead to session theft, content tampering, or privilege escalation for the viewing user; CVSS 3.1 score is 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis and no CISA KEV listing; vendor fix is available in version 1.27.14. Sites that restrict content authoring to trusted users are substantially less exposed.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid - Visual Drag and Drop Editor allows Stored XSS.27.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.