CVE-2026-5920 is a stored cross-site scripting vulnerability in the Bold Page Builder WordPress plugin affecting all versions up to 5.9.6. The issue stems from a bypassable security filter (bt_bb_save_pre) that can be circumvented using null byte injection, combined with inadequate sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. Authenticated attackers with Contributor-level privileges or above can exploit this to inject arbitrary web scripts that execute upon page access.

An attacker with Contributor-level or higher privileges can inject malicious scripts into pages via the vulnerable shortcode parameter. These scripts execute in the context of users viewing the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected shortcodes. Applying strict input validation and output sanitization on shortcode content may reduce risk.