What’s Vulnerable › Products
boldthemes Bold Page Builder vulnerabilities
47 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.
Check whether your boldthemes Bold Page Builder version is affected
Latest boldthemes Bold Page Builder vulnerabilities
- CVE-2026-88037 — Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title (CVSS 6.4)
- CVE-2026-6173 — Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter (CVSS 6.4)
- CVE-2026-6172 — Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter (CVSS 6.4)
- CVE-2026-6171 — Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute (CVSS 6.4)
- CVE-2026-6170 — Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute (CVSS 6.4)
- CVE-2026-5920 — Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter (CVSS 6.4)
- CVE-2026-62110 — WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-84028 — Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings (CVSS 6.8)
- CVE-2026-84022 — Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes (CVSS 6.8)
- CVE-2026-84021 — Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL (CVSS 6.8)
- CVE-2026-2357 — Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2026-3694 — Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode (CVSS 6.4)
- CVE-2026-25451 — WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-15267 — Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode (CVSS 6.4)
- CVE-2025-13463 — Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid (CVSS 6.4)
- CVE-2025-12803 — Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode (CVSS 6.4)
- CVE-2025-12159 — Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- CVE-2025-66057 — WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-7730 — Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter (CVSS 6.4)
- CVE-2025-58194 — WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2025-54006 — WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2024-5647 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4)
- CVE-2025-5286 — Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter (CVSS 6.4)
- CVE-2025-3715 — Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter (CVSS 6.4)
- CVE-2025-47525 — WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)