CVE-2026-5920

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-5920 Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

EUVD-2026-80111

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-5920

Bold Page Builder (WordPress plugin, versions up to and including 5.9.6 ) is vulnerable to Stored Cross-Site Scripting via the shortcode_content parameter of the bt_bb_shortcode shortcode. The root cause is a bypassable security filter (bt_bb_save_pre) that can be circumvented via null byte injec...

WordPress Bold Page Builder plugin <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'shortcodecontent' Parameter vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin Bold Page Builder versions = 5.9.6...

CVE-2026-62110

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

EUVD-2026-76210

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

CVE-2026-62110

CVE-2026-62110 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin, affecting versions 5.9.9 and earlier . The flaw was discovered by LevinityCyber and assigned a CVSS 3.1 score of 6.5 (MEDIUM) with a changed scope, requiring user interaction ...

CVE-2026-62110 WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Bold Page Builder versions = 5.9.9...

CVE-2026-84028

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84028 Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84028

CVE-2026-84028 affects the Bold Page Builder WordPress plugin before 5.9.9 . The root cause is an unsanitised and unescaped shortcode attribute in the Slider Elements' additional_settings , which is output directly into an HTML attribute. This allows authenticated users with the Contributor role ...

EUVD-2026-72064

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84021

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

CVE-2026-84022

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

EUVD-2026-71861

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Bold Page Builder versions 5.9.8...

CVE-2026-84021 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...