CVE-2026-84022
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
| Vendor | unknown |
| Product | bold page builder |
| Published | Sep 5, 2026 |
| Last Updated | Sep 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown bold page builder
Be the first to know when new medium vulnerabilities affecting unknown bold page builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Bold Page Builder
0 < 5.9.8
References
Credits
Revanth Hari Narayana Matte WPScan