The vulnerability CVE-2025-66057 in boldthemes Bold Page Builder (versions up to 5.5.2) is a DOM-based Cross-site Scripting issue resulting from improper input neutralization during web page generation. This flaw enables an attacker with low privileges and requiring user interaction to inject and execute malicious scripts, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring user interaction. The vulnerability is published and tracked but lacks vendor patch or advisory details in the provided information.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts due to DOM-based XSS. An attacker could execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, exploitation requires user interaction and low privileges, which reduces the overall risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure by restricting user input that can be rendered by the Bold Page Builder and educating users about the risks of interacting with untrusted content. Monitor vendor channels for updates and apply patches promptly once released.