WordPress Plugin Vulnerabilities

Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL

Description

The plugin does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.

Proof of Concept

Affects Plugins

Plugin icon
bold-page-builder
Fixed in 5.9.8

References

CVE
CVE-2026-84021

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Md. Minaruzzaman Shovon
Submitter
Md. Minaruzzaman Shovon
Submitter website
https://shovon.bd
Verified
Yes
WPVDB ID
ca226eab-59a2-42d5-96f6-84dacf7c6c5a

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2025-02-26
Title
BuddyBoss Platform < 2.8.00 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'
Published
2024-04-10
Title
Top Bar < 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-11-18
Title
WooCommerce Price Alert <= 1.0.4 - Reflected Cross-Site Scripting
Published
2024-12-11
Title
Cognito Forms <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Published
2026-05-01
Title
Simple Link Directory < 8.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes