CVE-2026-5920
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Bold Page Builder plugin for WordPress (all versions up to and including 5.9.6) is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode. This is due to a bypassable security filter (bt_bb_save_pre) circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when users visit them.
Risk Assessment
Stored XSS can lead to session theft, account takeover, or distribution of malicious code to site users. The risk is especially high if the site has many authors or editors.
Recommendation
Update the Bold Page Builder plugin to a version newer than 5.9.6 that contains the fix for this issue.
Other vulnerabilities in Bold Page Builder
See all- CVE-2026-62110Medium
The Bold Page Builder plugin in versions up to and including 5.9.9 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.
- CVE-2026-84028Medium
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
- CVE-2026-84022Medium
The Bold Page Builder WordPress plugin before version 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
- CVE-2026-84021Medium
The Bold Page Builder WordPress plugin before version 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
- CVE-2026-2357Medium
The Bold Page Builder plugin for WordPress up to version 5.6.8 is vulnerable to Stored Cross-Site Scripting via the 'bt_bb_shortcode' shortcode. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user visits an injected page.
- CVE-2025-15267Medium
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bt_bb_accordion_item shortcode in all versions up to and including 5.6.1 due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access can inject arbitrary web scripts into pages that execute when a user visits the injected page.
Original NVD description (English source)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter (bt_bb_save_pre) that can be circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS