The vulnerability CVE-2025-58194 in boldthemes Bold Page Builder (<= 5.4.3) is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This allows an attacker with some privileges to inject malicious scripts that are stored and later executed when other users view the affected content. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low complexity, requiring privileges and user interaction, and partial impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits exist in the wild.

Successful exploitation could allow an attacker with privileges to inject malicious scripts that execute in the context of other users viewing the affected pages, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and privileges to exploit, limiting the attack scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit privileges to trusted users and avoid exposing the vulnerable plugin to untrusted users. Monitor for updates from boldthemes and apply patches promptly once available.