The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table… (CVE-2026-78001)

CVE-2026-78001 describes a stored cross-site scripting vulnerability in the Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress. The flaw exists in the Table Designer component's handling of the 'data-label' attribute, where input is not properly sanitized or escaped before being stored and rendered. Authenticated attackers with Contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. The vulnerability affects all plugin versions up to and including 1.27.13.

Successful exploitation allows an attacker with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity with a medium severity score (CVSS 6.4).

No official patch or fix is currently documented. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Table Designer feature to reduce risk.