CVE-2024-1160 in Bold Page Builder Plugin
Summary
by MITRE • 02/13/2024
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-30442 is likely a duplicate of this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1160 affects the Bold Page Builder plugin for WordPress, representing a critical stored cross-site scripting weakness that has been present in all versions up to and including 4.8.0. This security flaw stems from inadequate input sanitization and output escaping mechanisms within the plugin's Icon Link functionality, creating a persistent vector for malicious code injection that can compromise user sessions and execute unauthorized scripts within the context of affected websites.
The technical implementation of this vulnerability occurs through the plugin's insufficient validation of user-supplied input when processing icon link parameters. When authenticated users with contributor-level permissions or higher create or modify pages containing malicious script code within the icon link field, the system fails to properly sanitize this input before storing it in the database. This stored malicious content then executes whenever any user accesses the affected page, making it a classic stored XSS vulnerability that operates outside the typical scope of reflected XSS attacks. The vulnerability is particularly concerning because it requires only contributor-level privileges to exploit, which is often granted to trusted users who may not be security-aware, and the attack vector is embedded within legitimate page building functionality.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform a wide range of malicious activities including session hijacking, credential theft, data exfiltration, and redirection to malicious websites. Since the vulnerability affects WordPress sites using the Bold Page Builder plugin, attackers can potentially compromise entire websites and their user bases, especially in environments where contributors have access to page editing capabilities. The stored nature of the vulnerability means that even if the initial injection occurs during a brief maintenance window, the malicious code remains persistent and can be triggered repeatedly by any user accessing the compromised pages, making it particularly dangerous for high-traffic or enterprise WordPress installations.
Mitigation strategies for CVE-2024-1160 should prioritize immediate plugin updates to versions that address the input sanitization and output escaping deficiencies. Organizations should implement strict role-based access controls to limit contributor privileges to only essential page editing functions and consider implementing additional security measures such as content security policies and web application firewalls to provide defense-in-depth. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and represents a clear violation of the principle of least privilege as defined in cybersecurity frameworks. From an ATT&CK perspective, this vulnerability maps to T1566.001 (Phishing: Spearphishing Attachment) and T1584.002 (Compromise Accounts: Credentials from Password Stores) as attackers can leverage the stored XSS to harvest session cookies and credentials from authenticated users, making it a significant threat vector that requires immediate remediation.
The relationship between CVE-2024-1160 and CVE-2024-30442 suggests a potential duplicate vulnerability within the same plugin ecosystem, indicating that the Bold Page Builder plugin may have multiple cross-site scripting vulnerabilities requiring comprehensive patching. Security teams should conduct thorough vulnerability assessments of all WordPress installations using this plugin to identify and remediate any additional affected components, while also implementing monitoring solutions to detect potential exploitation attempts through unusual page access patterns or unexpected script execution within user sessions.