CVE-2026-6170 describes a stored XSS vulnerability in the Bold Page Builder WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'images' parameter in the bt_bb_css_image_grid shortcode. Authenticated attackers with Contributor or higher privileges can inject arbitrary JavaScript code that is stored and executed in the context of users visiting the compromised pages. The vulnerability affects all plugin versions up to and including 5.7.2.

An attacker with Contributor-level access or higher can exploit this vulnerability to execute arbitrary scripts in the context of other users who view the injected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the affected site. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only, and consider disabling or limiting use of the affected shortcode. Monitor for updates from the plugin vendor regarding patches.