The Bold Page Builder plugin for WordPress contains a stored XSS vulnerability (CWE-79) via the data-text parameter in versions up to 5.3.5. This occurs because the plugin does not properly sanitize or escape input, allowing authenticated users with Contributor or higher privileges to inject arbitrary scripts into pages. These scripts execute in the context of any user who views the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level without user interaction. No patch or official fix has been documented in the provided data.

Successful exploitation allows authenticated users with Contributor-level access or above to inject and store malicious scripts within pages. These scripts execute in the browsers of users who access the injected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated XSS. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Bold Page Builder plugin. Monitor for plugin updates from boldthemes that address this vulnerability and apply them promptly once released.