CVE-2026-84022: CWE-79 Cross-Site Scripting (XSS) in Bold Page Builder

The Bold Page Builder WordPress plugin versions prior to 5.9.8 do not sanitize and escape multiple shortcode attributes before rendering them in HTML attributes. This improper handling enables users with Contributor or higher privileges to inject malicious JavaScript code, leading to a stored cross-site scripting (XSS) vulnerability. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 6.8, indicating a medium severity level. Exploitation requires at least Contributor privileges and user interaction (viewing the affected page). No known exploits in the wild have been reported. No official patch or remediation link is provided in the data.

Successful exploitation allows an attacker with Contributor or higher privileges to inject arbitrary web scripts that execute in the context of other users viewing the affected page. This can lead to compromise of user sessions, theft of sensitive information, or other malicious actions performed on behalf of the victim user. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and higher roles from untrusted users and review shortcode usage carefully. Monitor for updates from the Bold Page Builder plugin vendor and apply any official patches promptly once released.