CVE-2026-100510 describes an unauthenticated cross-site scripting (XSS) vulnerability in Post and Page Builder by BoldGrid, versions up to 1.27.14. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), enabling attackers to inject malicious scripts. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided in the input data.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary scripts in the context of the affected application without authentication. This may lead to partial compromise of confidentiality, integrity, and availability of the application or user data. The vulnerability affects the web interface of the product and could be leveraged to conduct phishing, session hijacking, or other malicious activities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the affected application. Monitor vendor channels for updates and patches.