CVE-2025-15267 is a stored cross-site scripting vulnerability in the Bold Page Builder WordPress plugin affecting versions up to 5.5.7. The issue stems from improper neutralization of input in the bt_bb_accordion_item shortcode, where user-supplied attributes are not adequately sanitized or escaped before being output on web pages. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. This vulnerability could lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of sensitive information or session tokens (confidentiality impact) and unauthorized modification of displayed content (integrity impact). There is no direct impact on system availability. The vulnerability requires authenticated access, limiting the attack surface to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Bold Page Builder plugin if possible. Monitor for plugin updates from boldthemes that address this vulnerability and apply them promptly once released.