The vulnerability resides in the bt_bb_raw_content shortcode of the Bold Page Builder plugin, which fails to sanitize and escape user supplied attributes. An authenticated user with contributor or higher privileges can embed arbitrary JavaScript within the shortcode, causing the code to be stored in the page content. When any visitor loads the page, the injected script will execute in their browser, potentially permitting credential theft, session hijacking, or defacement.

Boldthemes’ Bold Page Builder WordPress plugin, all releases up to and including version 5.4.8, are affected. Users who have installed these versions and allow contributors to edit pages that use the bt_bb_raw_content shortcode are at risk.

The CVSS score of 6.4 indicates a moderate-severity flaw. Its EPSS score of less than 1% suggests that exploitation is unlikely in the short term. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated as contributors or higher; they can inject the payload by creating or editing a page that contains the raw_content shortcode. No additional conditions beyond normal WordPress editing permissions are required.