CVE-2026-6170 describes a stored XSS vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.7.2. The vulnerability arises from insufficient sanitization and escaping of user input in the 'images' parameter of the bt_bb_css_image_grid shortcode. This allows authenticated attackers with Contributor or higher privileges to inject arbitrary web scripts that execute in the context of users viewing the compromised pages.

The vulnerability enables authenticated users with Contributor-level access or above to perform stored XSS attacks, potentially leading to session hijacking, defacement, or other malicious actions executed in the context of other users visiting the injected pages. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only and consider disabling or limiting use of the vulnerable shortcode to reduce risk.