Cross-site Scripting Vulnerability in Bold Page Builder by Bold Themes
CVE-2026-125680

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Bold Page Builder
Vendor
CVE Published:
11 November 2026

What is CVE-2026-125680?

The Bold Page Builder, developed by Bold Themes, is susceptible to a Cross-site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages generated by the plugin. This vulnerability arises due to improper neutralization of user inputs, leading to potential stored XSS attacks. It affects all versions of Bold Page Builder up to 5.9.11, posing serious risks for websites utilizing this plugin. Website owners should promptly update their installations to mitigate potential exploitations and ensure user safety.

Affected Version(s)

Bold Page Builder 0 <= 5.9.11

References

https://patchstack.com/database/wordpress/plugin/bold-pag...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khanh Nguyen | Patchstack Bug Bounty Program
.