CVE-2026-84021
UnknownSummary
The Bold Page Builder WordPress plugin before version 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
Risk Assessment
Script injection via links can lead to data theft, session hijacking, or redirecting users to malicious sites.
Recommendation
Update the Bold Page Builder plugin to version 5.9.8 or later, which includes a fix for link URL validation.
Other vulnerabilities in Bold Page Builder
See all- CVE-2026-84022Unknown
The Bold Page Builder WordPress plugin before version 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
- CVE-2026-2357Medium
The Bold Page Builder plugin for WordPress up to version 5.6.8 is vulnerable to Stored Cross-Site Scripting via the 'bt_bb_shortcode' shortcode. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user visits an injected page.
Original NVD description (English source)
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.