Description

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-06T07:16:43.320Z",
  "pubdate": "2026-09-06T07:16:43.320Z",
  "executiveSummary": "The Bold Page Builder WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation and output encoding of shortcode attributes.\nThis vulnerability allows authenticated users with the Contributor role or higher to inject malicious JavaScript payloads into page content.\nWhen a victim, such as an administrator, views the compromised page, the injected script executes within the context of their session, potentially leading to unauthorized administrative actions, session hijacking, or site-wide compromise.\nThe flaw affects all versions of the Bold Page Builder plugin prior to 5.9.9.\nGiven that the Contributor role is relatively common in collaborative WordPress environments, the risk level is significant due to the potential for privilege escalation and cross-site request forgery (CSRF) via script execution.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of user-supplied data within shortcode attributes. Specifically, the Bold Page Builder plugin fails to perform adequate sanitization and output escaping on attributes before rendering them into the HTML document object model (DOM).\nIn WordPress, shortcodes are processed by registered handler functions. If these functions take user-supplied input from the shortcode attributes and output them directly into an HTML attribute (such as 'value', 'title', or 'href') without first passing the data through appropriate WordPress escaping functions like esc_attr() or esc_js(), an attacker can break out of the HTML attribute context.\nAn attacker with Contributor-level privileges can craft a post or page containing a malicious shortcode. By injecting a payload designed to close the current HTML attribute (e.g., using a double quote or single quote) and inserting event handlers such as 'onmouseover' or 'onerror', the attacker can execute arbitrary JavaScript in the victim's browser.\nThe attack flow is as follows: 1) An authenticated attacker inserts a specially crafted shortcode attribute into a post or page. 2) The plugin server-side logic processes the shortcode but fails to escape the dangerous character sequences in the attribute. 3) The malicious HTML is saved to the WordPress database. 4) When an unsuspecting user (with higher privileges) visits the page, the server renders the stored malicious attribute as part of the HTML output. 5) The victim's browser executes the injected script.\nBecause the execution happens within the victim's browser session, the script inherits the victim's authentication tokens and administrative capabilities. This allows the attacker to perform actions on behalf of the victim, such as modifying plugin settings, creating new administrative accounts, or redirecting site traffic, effectively resulting in complete site compromise if an administrator views the infected page."
}