CVE-2026-84022

Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

Affected

Bold Page Builder

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-09-05

Updated

2026-09-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/53bbe80c-caea-4893-82a6-03e5173390de/

References

• CVE Record
• NVD entry