The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute,… (CVE-2026-84028)

CVE-2026-84028 describes a cross-site scripting vulnerability in the Bold Page Builder WordPress plugin prior to version 5.9.9. The plugin fails to sanitize and escape a shortcode attribute before outputting it in an HTML attribute context. This allows users with Contributor privileges or above to inject malicious scripts that execute in the browsers of users viewing the affected pages. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation allows an attacker with Contributor or higher privileges to perform stored cross-site scripting attacks, potentially leading to full compromise of user sessions, theft of sensitive information, or execution of arbitrary actions in the context of affected users. The CVSS 3.1 score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, required privileges of high (Contributor role), and user interaction required.

A fix is available in version 5.9.9 of the Bold Page Builder plugin. Users should upgrade to version 5.9.9 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.