The Post and Page Builder by BoldGrid WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with contributor or higher privileges can inject arbitrary scripts via an unspecified parameter, which are then stored and executed in the context of any user viewing the affected page. This can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability affects versions up to 1.26.4. No vendor advisory or patch information is provided, and no known exploits have been reported.

An attacker with contributor-level permissions or higher can inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information accessible via the browser, or other client-side impacts. The vulnerability does not impact availability. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider additional input validation or output encoding controls if possible. Monitor for updates from BoldGrid regarding patches or official mitigations.