CVE-2026-6173 in Bold Page Builder Plugin
Summary
by MITRE • 09/30/2026
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The Bold Page Builder plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 5.7.2. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, specifically identified under CWE-80 in the Common Weakness Enumeration framework. The vulnerability resides within the bt_bb_section shortcode, which allows users to define various visual attributes for page sections. Among these attributes, the background_image parameter fails to properly sanitize user-supplied input or escape it during output rendering. This lack of rigorous validation and encoding creates a direct pathway for malicious actors to inject executable JavaScript code into the application's stored data.
The operational impact of this vulnerability is significant because it allows authenticated attackers with Contributor-level access or higher privileges to persistently embed arbitrary web scripts within pages created through the plugin. Unlike reflected XSS, where the payload is executed only when a specific link is clicked, stored XSS persists on the server side. Consequently, every user who accesses a page containing the injected script will have their browser execute the malicious code automatically. This can lead to severe consequences such as session hijacking, credential theft, defacement of the website, or redirection to phishing sites that compromise end-user security and trust in the application.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. The attacker leverages insufficient input sanitization (CWE-20) to bypass expected data formats and output escaping failures (CWE-79) to ensure the script runs in the victim's context. Because the payload is stored in the database or file system via the plugin’s shortcode structure, it remains active until manually removed by an administrator, making detection and remediation more challenging than transient vulnerabilities.
To mitigate this risk, immediate action is required for all systems running Bold Page Builder versions 5.7.2 or earlier. The primary mitigation strategy is to upgrade the plugin to a patched version where the developers have implemented robust input validation and output encoding mechanisms specifically targeting the background_image parameter. Administrators should also enforce strict role-based access controls to limit who can create or edit pages using this shortcode, ensuring that only trusted users with administrative privileges can modify critical page structures until the patch is applied. Additionally, implementing a Web Application Firewall (WAF) with rules tuned for XSS patterns can provide an additional layer of defense by blocking malicious payloads before they are stored in the database.