6.8
Medium
CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before…
Description
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Bold Page Builder 5.9 | earliest → < 5.9.8 | 5.9.8 |
Other CVEs of Bold Page Builder
The 5 CVEs of Bold Page Builder →
CVE-2026-84028
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting…
6.8
Medium
CVE-2026-84021
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an…
6.8
Medium
CVE-2022-2089
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow…
Not rated
CVE-2021-24579
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the…
Not rated