CVE-2026-84021: CWE-79 Cross-Site Scripting (XSS) in Bold Page Builder

The Bold Page Builder WordPress plugin versions prior to 5.9.8 contain a CWE-79 Cross-Site Scripting vulnerability. The issue arises from improper validation of link URLs before they are output in HTML attributes. The plugin relies on a filter for validation that can be evaded, enabling users with Contributor or higher privileges to inject malicious scripts. These scripts execute upon user interaction with the crafted link, potentially leading to confidentiality, integrity, and availability impacts as indicated by the CVSS vector.

Successful exploitation allows an attacker with Contributor or higher privileges to inject and execute arbitrary JavaScript in the context of users who click the malicious link. This can lead to full confidentiality, integrity, and availability compromise of the affected system or user session. The CVSS score of 6.8 reflects a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Until a patch is available, restrict Contributor or higher roles from untrusted users and avoid clicking suspicious links generated by the plugin.