WordPress Plugin Vulnerabilities

Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

Description

The plugin does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

Proof of Concept

Affects Plugins

Plugin icon
bold-page-builder
Fixed in 5.9.8

References

CVE
CVE-2026-84022

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
53bbe80c-caea-4893-82a6-03e5173390de

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2023-01-13
Title
Happyforms < 1.22.0 - Contributor+ Stored XSS
Published
2024-11-08
Title
Postify: Post Layout For Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-07-01
Title
Newspack Campaigns < 2.31.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2015-02-22
Title
Contact Form DB < 2.8.28 - Authenticated Cross-Site Scripting (XSS)
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Stored Cross-Site Scripting