CVE-2026-6172 is a stored XSS vulnerability in the Bold Page Builder plugin for WordPress. It arises from insufficient sanitization and escaping of the 'caption' parameter in the bt_bb_image shortcode. Authenticated attackers with Contributor or higher privileges can inject arbitrary JavaScript into pages, which executes in the context of users viewing those pages. The vulnerability affects all versions from 0 up to and including 5.7.2.

An attacker with Contributor-level access or higher can inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the injected script's capabilities. The vulnerability does not affect unauthenticated users directly but leverages authenticated user privileges to persist malicious code.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the Bold Page Builder plugin if possible. Review and sanitize all user-generated content involving the 'caption' parameter to mitigate exploitation.