CVE-2022-2089: vulnerability in Bold Page Builder
Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.1%
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Affected products
Unknown · Bold Page BuilderRelated CVEs — Bold Page Builder
In the same product, most dangerous first.
CVE-2021-24579—Bold Page Builder < 3.1.6 - PHP Object InjectionEPSS 8.2%CVE-2026-84028MEDIUMBold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settingsEPSS 0.4%CVE-2026-84022MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element AttributesEPSS 0.4%CVE-2026-84021MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLEPSS 0.4%