Stored Cross-Site Scripting in Bold Page Builder Plugin for WordPress

CVE-2025-15267

What is CVE-2025-15267?

The Bold Page Builder plugin for WordPress presents a Stored Cross-Site Scripting vulnerability through the bt_bb_accordion_item shortcode. This arises from inadequate input sanitization and output escaping on attributes provided by users. Authenticated attackers with contributor-level access or higher can exploit this weakness to inject malicious web scripts. These scripts will execute when any user accesses the compromised page, potentially leading to unauthorised access and data breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References