The Post and Page Builder by BoldGrid plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the boldgrid_canvas_image AJAX endpoint does not adequately sanitize or escape input from file uploads, enabling authenticated users with Contributor or higher privileges to embed malicious scripts in SVG files. These scripts execute in the context of users viewing the pages containing the SVG, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.26.6 and has a CVSS 3.1 score of 6.4 (medium severity). No known exploits in the wild have been reported, and no official patch or remediation link is currently provided.

An authenticated attacker with Contributor-level or higher access can exploit this vulnerability to inject and store malicious scripts in SVG files uploaded via the plugin. These scripts execute in the browsers of users who view the affected pages, potentially allowing theft of session tokens, defacement, or other script-based attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authentication and privileges above a basic subscriber, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher user permissions to trusted users only. Consider disabling or limiting file upload capabilities in the plugin if feasible. Monitor vendor channels for updates or patches addressing this vulnerability.