CVE-2026-84022mediumCWE-79

CVE-2026-84022: medium-severity vulnerability in Bold Page Builder

Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

Published · Updated

Follow this CVE+ Monitor Bold Page Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.4%
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Bold Page Builder
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Bold Page Builder

In the same product, most dangerous first.

CVE-2021-24579—Bold Page Builder < 3.1.6 - PHP Object InjectionEPSS 8.2%CVE-2022-2089—Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2026-84028MEDIUMBold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settingsEPSS 0.4%CVE-2026-84021MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLEPSS 0.4%