CVE-2026-7438 is a stored cross-site scripting vulnerability in the Bold Timeline Lite WordPress plugin. It arises from insufficient sanitization and escaping of user-supplied input in the 'supertitle' and 'subtitle' attributes of the 'bold_timeline_item' shortcode. This allows authenticated attackers with Contributor or higher privileges to inject malicious scripts into pages, which execute in the context of users who access those pages. The vulnerability affects all versions from 0 up to and including 1.2.8.

An attacker with Contributor-level or higher access can inject arbitrary JavaScript code into pages via the vulnerable shortcode attributes. This can lead to execution of malicious scripts in the browsers of users who view the injected content, potentially resulting in session hijacking, privilege escalation, or other client-side attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented. Users should restrict Contributor-level access to trusted users and consider disabling or removing the Bold Timeline Lite plugin until a fix is available. Monitor the vendor's advisory channels for updates. Since this is not a cloud service, remediation depends on applying vendor patches or workarounds when released.