CVE-2026-5920 in Bold Page Builder Plugin
Summary
by MITRE • 09/16/2026
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter (bt_bb_save_pre) that can be circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Bold Page Builder plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting all versions up to 5.9.6. This flaw resides within the bt_bb_shortcode shortcode handler, specifically triggered through the 'shortcode_content' parameter. The root cause of this security issue is twofold: first, there is an insufficient sanitization mechanism when processing base64-decoded content in the bt_bb_raw_content shortcode handler, and second, a critical security filter named bt_bb_save_pre can be bypassed using null byte injection techniques. This combination allows malicious actors to inject arbitrary web scripts into WordPress pages that are stored on the server rather than being transient or session-based.
The operational impact of this vulnerability is significant because it enables authenticated attackers with Contributor-level access and above to execute code in the context of other users' browsers. When a victim user accesses a page containing the injected script, the malicious payload executes automatically within their browser environment. This can lead to severe consequences including account hijacking through session cookie theft, defacement of website content, redirection to phishing sites, or further propagation of malware across the network if combined with additional exploits. The stored nature of this vulnerability means that every user viewing the compromised page is potentially affected without any direct interaction required from them beyond loading the page.
From a technical classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involving null byte injection to bypass filters relates to CWE-625, Perceived but Incorrectly Implemented Security Filter or Bypass. Additionally, the attack vector where an authenticated user injects persistent malicious content that affects other users maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under sub-techniques involving web browsers such as JavaScript execution. The requirement for authentication places this within the scope of privilege escalation or abuse of existing permissions rather than unauthenticated remote code execution.
Mitigation strategies should prioritize immediate patching to version 5.9.7 or later where these issues have been addressed by the developers. In environments where upgrading is not immediately feasible, administrators can implement Web Application Firewall rules that detect and block null byte sequences in POST requests targeting WordPress shortcode parameters. Additionally, enforcing strict input validation on all user-supplied data before it enters any database storage operations would prevent the initial injection. It is also recommended to restrict contributor-level access for untrusted users until the patch is applied, as this vulnerability specifically targets accounts with at least Contributor privileges. Regular security audits and code reviews focusing on output encoding practices are essential to preventing similar vulnerabilities in future updates or custom implementations of page builder plugins.