The Bold Page Builder plugin for WordPress contains a stored Cross‑Site Scripting (XSS) vulnerability in its Post Grid component. If an attacker with Author‑level or higher access injects malicious script code into a post grid entry, the code is stored in the database and executed whenever the affected page is viewed. This can lead to defacement, theft of session cookies, credential dumping, or execution of arbitrary client‑side actions on all users that load the page.

WordPress sites running the Bold Page Builder plugin, version 5.5.3 or earlier. The vulnerability exists in all releases of the plugin up to and including 5.5.3 and affects any installation where a user with Author or higher role can edit post grids.

The CVSS score of 6.4 classifies the issue as medium severity, and the EPSS score of less than 1 % indicates that exploitation is currently considered unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated session; an attacker must log in with Author or greater privileges, create or edit a post grid entry with malicious payload, and allow end users to view the affected content. Once these conditions are satisfied, the stored payload will run in the browser context of all visitors to the page.