CVE-2026-84022: CWE-79 Cross-Site Scripting (XSS) in Bold Page Builder

CVE-2026-84022 is a cross-site scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin prior to version 5.9.8. The issue arises from insufficient sanitization and escaping of multiple shortcode attributes before they are rendered in HTML attributes. This flaw allows users with Contributor or higher privileges to inject arbitrary JavaScript code, which executes in the context of users viewing the affected pages. The vulnerability has not been confirmed to have known exploits in the wild, and no official patch or remediation guidance is currently documented.

Successful exploitation allows users with Contributor or higher roles to inject and execute arbitrary scripts in the browsers of users who view the affected pages. This can lead to compromise of user sessions, defacement, or other malicious actions impacting confidentiality, integrity, and availability of the affected WordPress site. The CVSS score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and higher user roles from adding or editing shortcodes, or disable the Bold Page Builder plugin if possible to prevent exploitation.