CVE-2026-84028: CWE-79 Cross-Site Scripting (XSS) in Bold Page Builder

CVE-2026-84028 is a CWE-79 Cross-Site Scripting vulnerability in the Bold Page Builder WordPress plugin. The flaw arises because the plugin does not properly sanitize and escape a shortcode attribute before embedding it in an HTML attribute. This enables users with Contributor or higher privileges to inject malicious scripts that execute in the context of other users viewing the page. The vulnerability affects versions prior to 5.9.9, though no explicit affected versions were provided. The CVSS 3.1 base score is 6.8, indicating a medium severity with network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with Contributor or higher privileges to execute arbitrary JavaScript in the browsers of users who view the affected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the context of the affected site. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor and higher roles from adding or editing shortcodes or content that could exploit this vulnerability. Monitor for updates from the plugin vendor and apply updates promptly once available.