Description

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T19:17:43.850Z",
  "pubdate": "2026-09-11T19:17:43.850Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within Bold Page Builder versions 5.9.9 and earlier. The flaw allows authenticated users with contributor-level privileges to inject malicious scripts into page content.\nThis vulnerability is classified as a Stored XSS issue, which poses a significant security risk by enabling attackers to execute arbitrary JavaScript in the context of other users' sessions, including those with higher administrative privileges.\nThe impact includes the potential for unauthorized actions, session hijacking, defacement of the website, and the exfiltration of sensitive information such as authentication tokens or session cookies.\nThe vulnerability originates from insufficient input sanitization of data handled by the page builder interface. By manipulating specific inputs, an attacker can bypass standard security controls to store executable scripts.\nExploitation requires a valid user account with at least contributor-level access to the WordPress dashboard. Once the malicious payload is stored within the page content, it executes whenever a legitimate user—specifically an administrator—views or edits the compromised page.\nThis vulnerability highlights a critical failure in the plugin's ability to enforce strict input validation and output encoding for content managed by lower-privileged roles.",
  "technicalDetails": "The vulnerability is rooted in the insufficient sanitization of user-supplied data during the save or update operations within the Bold Page Builder plugin. Specifically, the component responsible for processing page builder elements fails to properly sanitize or validate metadata and content attributes submitted by users with contributor-level permissions.\nThe attack flow begins when an authenticated attacker, operating with contributor credentials, leverages the plugin's interface to construct a page or post. During this process, the attacker injects malicious JavaScript payloads into fields that the plugin subsequently stores in the WordPress database without applying adequate output encoding or context-aware sanitization.\nWhen a user with higher administrative privileges accesses the backend interface to view or edit the compromised page, the Bold Page Builder plugin retrieves the stored data and renders it within the browser. Because the injected payload is not neutralized, the browser interprets the script tag or event handler as legitimate content, triggering execution within the security context of the victim's authenticated session.\nThis Stored XSS attack is particularly dangerous because the script executes automatically upon the target user's interaction with the affected page. The payload can be crafted to perform unauthorized actions on behalf of the victim, such as creating new administrative accounts, modifying site configuration settings, or exfiltrating data via HTTP requests to an attacker-controlled server.\nThe vulnerable component is identified as the core processing engine of the Bold Page Builder, which manages the translation of builder-specific shortcodes and dynamic content into HTML. The lack of validation occurs specifically during the deserialization and rendering of component attributes. Given that WordPress contributor roles have restricted capabilities, the fact that the plugin allows these users to inject scripts indicates a failure to enforce the principle of least privilege regarding the data processing pipeline.\nThe security impact is exacerbated by the nature of administrative access; if an administrator's browser executes the payload, the attacker effectively gains the ability to perform any action the administrator can perform within the WordPress dashboard, leading to a complete compromise of the site's integrity."
}