Description

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T07:16:30.910Z",
  "pubdate": "2026-08-16T07:16:30.910Z",
  "executiveSummary": "The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'bt_bb_shortcode' shortcode across all versions up to, and including, 5.6.8. This security flaw stems from insufficient input sanitization and output escaping mechanisms applied to user-supplied attributes processed by the shortcode.\nThe vulnerability allows authenticated attackers possessing contributor-level access and above to inject arbitrary web scripts and malicious payloads into pages and posts. When unsuspecting users or administrators access the compromised pages, the injected scripts execute within the context of their browser sessions.\nThe primary risk implication involves potential session hijacking, unauthorized administrative actions, and further compromise of the WordPress environment. Exploitation requires authenticated access with a minimum privilege level of a contributor, meaning an attacker must first obtain valid credentials or leverage social engineering to compromise a low-privileged account on the target WordPress installation.",
  "technicalDetails": "The vulnerability resides within the 'bt_bb_shortcode' shortcode handler implemented by the Bold Page Builder plugin. The root cause of the flaw is the improper handling of user-supplied attributes during shortcode parsing and rendering. Specifically, the plugin fails to perform adequate input sanitization when data is received and lacks proper output escaping when rendering the attributes back to the Document Object Model (DOM).\nBecause WordPress executes shortcodes during page rendering, any malicious HTML or JavaScript injected into vulnerable shortcode attributes is stored persistently within the database. The vulnerable component processes these inputs insecurely, allowing arbitrary payload storage.\nThe attack flow proceeds as follows: First, an authenticated attacker with contributor-level privileges or higher creates or edits a WordPress post or page using the Bold Page Builder interface. Second, the attacker inserts the 'bt_bb_shortcode' shortcode containing malicious JavaScript payloads embedded within vulnerable attributes. Third, the crafted shortcode is saved to the database without being properly sanitized. Finally, when any user—including high-privileged administrators—views the rendered page, the browser parses the unescaped payload, leading to arbitrary script execution within the victim's browser session.\nThe attack vector involves network exposure via HTTP/HTTPS through the standard WordPress web interface. The exploitation requirements mandate authenticated access with contributor-level privileges. The payload behavior executes arbitrary JavaScript in the context of the victim's session, enabling post-exploitation activities such as session theft, unauthorized privilege escalation via the creation of rogue administrator accounts, or arbitrary actions performed on behalf of the victim."
}