The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'target' parameter of the bt_bb_icon shortcode. This affects all versions up to and including 5.7.2. The flaw allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.