CVE-2026-6170 in Bold Page Builder Plugin
Summary
by MITRE • 09/30/2026
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within the Bold Page Builder plugin for WordPress represents a significant security risk stemming from insufficient input sanitization and output escaping mechanisms. Specifically, this flaw is located within the bt_bb_css_image_grid shortcode, which processes the images parameter without adequately validating or encoding user-supplied data. This architectural weakness allows malicious actors to inject arbitrary web scripts into the application's content storage. The vulnerability affects all versions of the plugin up through 5.7.2, indicating a persistent issue in how the software handles dynamic content generation for page layouts.
From an operational perspective, this flaw facilitates Stored Cross-Site Scripting attacks. Unlike reflected XSS where malicious code is executed immediately within a victim's browser via a crafted link, stored vulnerabilities persist on the target server. In this context, authenticated attackers with Contributor-level access or higher can embed script payloads into pages that are subsequently saved to the database. These scripts remain active and will execute automatically whenever any user accesses an affected page. This persistence transforms what might otherwise be a transient issue into a long-term threat vector capable of compromising multiple users over time without requiring repeated exploitation attempts by the attacker.
The impact of this vulnerability extends beyond simple script execution, potentially leading to session hijacking, credential theft, defacement of website content, or redirection of victims to malicious sites. Since the attack requires only Contributor-level access, it is relatively easy for lower-privileged users within a WordPress environment to exploit. This lowers the barrier to entry for attackers who may have gained initial foothold through other means such as weak passwords or compromised credentials. The ability to inject scripts into pages viewed by administrators or other high-value targets amplifies the severity of the compromise, potentially leading to full site takeover if combined with additional vulnerabilities.
In terms of industry standards classification, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious content for later execution places it firmly within the stored variant of XSS. Furthermore, from a tactical standpoint related to the MITRE ATT&CK framework, this behavior corresponds to techniques involving client-side code injection and potentially credential harvesting through phishing or session hijacking methods. Understanding these classifications helps in mapping the vulnerability to broader threat intelligence models and prioritizing remediation efforts based on established risk frameworks.
Mitigation strategies should prioritize immediate updates to version 5.7.3 or later where this issue has been addressed by the developers. Until an update is applied, administrators can implement temporary workarounds such as restricting Contributor-level access if not strictly necessary for all users involved in content creation. Additionally, deploying a Web Application Firewall with rules specifically tuned to detect and block XSS payloads in POST requests targeting WordPress shortcodes can provide an additional layer of defense. Regular security audits focusing on input validation and output encoding practices across custom plugins are also recommended to prevent similar vulnerabilities from arising in other parts of the application stack.