CVE-2026-6172 in Bold Page Builder Plugin
Summary
by MITRE • 09/30/2026
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The Bold Page Builder plugin for WordPress contains a critical security vulnerability identified as Stored Cross-Site Scripting within the bt_bb_image shortcode's caption parameter across all versions up to 5.7.2. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing user-supplied attributes, allowing malicious actors to inject arbitrary web scripts into page content. The persistence of this vulnerability classifies it as a stored attack vector rather than a reflected one, meaning the injected code is saved on the server-side database and executed every time an affected page is loaded by any visitor.
From a technical perspective, the root cause lies in the plugin's failure to properly validate or escape special characters within the caption field before rendering them into HTML output. When an authenticated user with Contributor-level access or higher submits content containing malicious JavaScript payloads via this parameter, the system stores these inputs without adequate protection against script execution. Consequently, when other users navigate to pages utilizing this shortcode, their browsers interpret and execute the embedded scripts in the context of the vulnerable site's domain. This behavior aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as a common cause for cross-site scripting vulnerabilities.
The operational impact of this vulnerability is significant due to its stored nature and relatively low privilege requirement for exploitation. Attackers requiring only Contributor-level access can compromise the integrity and security posture of the entire WordPress installation. Successful exploitation enables session hijacking, where attackers steal administrative cookies or user sessions to gain unauthorized control over accounts. It also facilitates credential theft through phishing pages hosted on the legitimate domain, defacement of website content by altering displayed text or images, and potentially redirecting users to malicious external sites designed for malware distribution. This aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution within web browsers as a method for initial access and further lateral movement.
Mitigation strategies must prioritize immediate remediation through software updates alongside defensive configuration changes. Administrators should upgrade the Bold Page Builder plugin to version 5.7.3 or later where these sanitization issues have been addressed by the developers. In environments where updating is not immediately feasible, implementing a Web Application Firewall can help filter out malicious payloads targeting the caption parameter before they reach the application logic. Additionally, enforcing strict Content Security Policy headers that restrict script execution to trusted sources only can mitigate the impact of any successfully injected scripts by preventing them from executing in user browsers. Regular security audits and code reviews focusing on input validation and output encoding practices are essential for maintaining long-term resilience against such injection-based attacks.