CVE-2026-84021 in Bold Page Builder Plugin
Summary
by MITRE • 09/05/2026
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Bold Page Builder versions prior to 5.9.8 represents a significant security flaw within the WordPress ecosystem, specifically categorized as an Unvalidated Redirect or Open URL Injection with Cross-Site Scripting implications. This issue stems from inadequate input validation mechanisms when handling user-supplied data for link URLs. The plugin processes these inputs through a filter system intended to sanitize or validate the data before it is rendered in the HTML output. However, this security control can be bypassed by attackers who possess at least Contributor-level permissions within the WordPress environment. This permission threshold is particularly concerning because Contributors are often trusted users with limited administrative privileges but sufficient access to create and edit content, making them a viable vector for exploitation without requiring full administrator compromise.
From a technical perspective, the core of the vulnerability lies in how the plugin constructs HTML attributes containing URLs. Instead of strictly validating that the input conforms to expected protocols such as HTTP or HTTPS while explicitly blocking dangerous schemes like JavaScript, the implementation relies on a filter that can be evaded. When an attacker injects a malicious payload disguised as a URL scheme, specifically using javascript: followed by arbitrary script code, the application fails to strip or neutralize this content. Consequently, when the page is rendered in a victim's browser, the injected script becomes part of the DOM structure associated with the link element. This failure to enforce strict output encoding and input validation allows for the execution of client-side scripts under specific conditions.
The operational impact of this vulnerability centers on Cross-Site Scripting (XSS), specifically reflected or stored XSS depending on how the data is persisted and served. Since the script executes when a user clicks the affected link, it constitutes an event-driven XSS attack. An attacker can craft a malicious URL that, upon activation by a victim, runs arbitrary JavaScript in the context of the vulnerable website. This enables a range of malicious activities including session hijacking through theft of cookies or authentication tokens, defacement of the webpage content, redirection to phishing sites designed to steal credentials from other users, and potentially keylogging if the injected script monitors user input fields. The severity is amplified by the fact that it requires only Contributor-level access, which is a relatively low bar for exploitation in many WordPress installations where multiple authors or editors have accounts.
In terms of industry standards, this vulnerability aligns with CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) and CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). The reliance on evadable filters highlights a common anti-pattern known as CWE-20: Improper Input Validation, where the application assumes that external sanitization layers are sufficient without implementing defense-in-depth strategies. From an offensive security perspective, this behavior maps directly to MITRE ATT&CK technique T1059.007: Command and Scripting Interpreter::JavaScript, which describes how attackers use JavaScript within web applications to execute malicious actions on the client side. The attack vector is classified as Local Network or Adjacent if internal users are targeted, but generally falls under Remote with Low Complexity due to the social engineering aspect of getting a user to click a link.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the Bold Page Builder plugin to version 5.9.8 or later, where the developers have addressed this validation flaw by implementing stricter URL scheme whitelisting and robust output encoding. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include restricting Contributor-level access to trusted individuals only and enabling Content Security Policy (CSP) headers that restrict script execution sources. Additionally, administrators should audit user roles to ensure the principle of least privilege is enforced, minimizing the number of users with elevated permissions who could potentially exploit this flaw. Regular security audits and penetration testing focused on input validation in WordPress plugins are essential to detect similar vulnerabilities before they can be exploited in production environments.