WordPress Plugin Vulnerabilities

Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings

Description

The plugin does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

Proof of Concept

Affects Plugins

Plugin icon
bold-page-builder
Fixed in 5.9.9

References

CVE
CVE-2026-84028

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Luka Zimonjic
Submitter
Luka Zimonjic
Verified
Yes
WPVDB ID
6abd5d49-af3a-4515-ba33-57b56a9fba4e

Timeline

Publicly Published
2026-09-04 (about 2 days ago)
Added
2026-09-04 (about 1 day ago)
Last Updated
2026-09-04 (about 1 day ago)

Other

Published
Title
Published
2020-01-06
Title
Ultimate FAQ < 1.8.30 - Unauthenticated Reflected XSS
Published
2025-06-09
Title
Smash Balloon Custom Facebook Feed < 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
Published
2026-05-26
Title
Easy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2025-11-10
Title
Magazine Companion < 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-09-17
Title
Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS