Exposure of Bold Themes

WordPress themes
81
exposure score
3,349
sites use
0
exploited
11
critical
Vexday analysis

Com 53 CVEs catalogadas, os produtos da Bold Themes acumulam um histórico relevante de vulnerabilidades, sendo 11 delas classificadas como críticas — volume que merece atenção em ambientes de produção. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, sem registros confirmados de exploração em larga escala no momento. No entanto, o CVE mais perigoso identificado, CVE-2021-24321, apresenta um score EPSS de aproximadamente 0,67, indicando probabilidade relativamente elevada de exploração real, o que justifica priorização no processo de remediação. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que sugere controles insuficientes de sanitização de entrada e saída nos temas analisados.

CVEs

57 results
CVE-2024-52417HIGHWordPress ReConstruction theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5920MEDIUMBold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' ParameterEPSS 0.3%CVE-2025-47488MEDIUMWordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-14032MEDIUMBold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' ShortcodeEPSS 0.3%CVE-2026-3694MEDIUMBold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button ShortcodeEPSS 0.3%CVE-2025-13463MEDIUMBold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post GridEPSS 0.3%CVE-2025-12803MEDIUMBold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs ShortcodeEPSS 0.3%CVE-2025-15267MEDIUMBold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item ShortcodeEPSS 0.3%CVE-2024-43294MEDIUMWordPress Bold Timeline Lite plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-25451MEDIUMWordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-7730MEDIUMBold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` ParameterEPSS 0.2%CVE-2026-62110MEDIUMWordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12159MEDIUMBold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-54006MEDIUMWordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-66057MEDIUMWordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58194MEDIUMWordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-68513MEDIUMWordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%