CVE-2026-7438 in Bold Timeline Lite Plugin
Summary
by MITRE • 09/11/2026
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Bold Timeline Lite plugin for WordPress contains a critical security vulnerability affecting all versions up to 1.2.8. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, which arises from insufficient input sanitization and output escaping mechanisms within the software's shortcode processing logic. Specifically, the vulnerability targets the supertitle and subtitle attributes of the bold_timeline_item shortcode. Because these parameters are not properly validated or encoded before being rendered in HTML content, they serve as injection points for malicious scripts. This type of flaw is formally categorized under CWE-79, which describes Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. The lack of robust filtering allows user-supplied data to bypass security controls and be executed directly by the victim's browser.
The operational impact of this vulnerability is significant due to its stored nature. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, stored XSS persists on the target server. When an attacker injects arbitrary web scripts via these attributes, the malicious code becomes part of the page content itself. Consequently, every time any user accesses a page containing this injected shortcode, the script executes automatically in their browser session. This persistence ensures that the attack does not rely on social engineering for each instance but rather leverages the normal browsing behavior of site visitors to trigger the payload repeatedly.
Access requirements for exploiting this vulnerability are relatively low, which increases its risk profile within typical WordPress environments. The exploit requires authenticated access with Contributor-level permissions or higher. In many standard WordPress installations, contributors have the ability to create and edit posts that utilize shortcodes. This means that a malicious actor who has compromised an account at this privilege level can easily introduce the harmful code into published content without needing administrative rights. Once injected, the payload remains active until manually removed by an administrator, creating a prolonged window of exposure for all site visitors.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of Command and Control or Initial Access phases depending on the payload intent. Attackers can leverage this capability to steal session cookies, perform keylogging, deface websites, or redirect users to phishing sites. The persistence of the script allows for continuous data exfiltration if combined with beaconing techniques, making it a potent tool for long-term unauthorized access and surveillance against site administrators and regular users alike.
To mitigate this risk, immediate action is required by all website owners running versions of Bold Timeline Lite up to 1.2.8. The primary remediation step is to upgrade the plugin to version 1.2.9 or later, where the developers have implemented proper input sanitization and output escaping for the affected attributes. Until an update can be applied, administrators should restrict contributor-level access if possible and manually audit existing posts for any suspicious shortcode usage containing script tags in supertitle or subtitle fields. Additionally, implementing a Web Application Firewall with rules specifically designed to detect and block XSS payloads can provide an additional layer of defense against exploitation attempts while the patch is being deployed.