HTML Injection Vulnerability in Bold Page Builder WordPress Plugin
CVE-2026-84028
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84028?
The Bold Page Builder WordPress plugin versions prior to 5.9.9 contains a vulnerability that fails to properly sanitize and escape shortcode attributes before rendering them in HTML. This oversight permits users with Contributor role or higher to inject arbitrary web scripts, which could execute seamlessly when another user accesses the affected page. This vulnerability can be exploited to compromise user data and undermine the overall integrity of the website.
Affected Version(s)
Bold Page Builder 0 < 5.9.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.