The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the title attribute of the bt_bb_service shortcode. This affects all versions up to and including 5.7.2. Authenticated users with Contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes.