Improper neutralization of user input during page rendering in the WordPress Post and Page Builder by BoldGrid results in a stored cross‑site scripting (XSS) flaw. Attackers can embed malicious scripts that execute in the browser when the affected page is viewed, potentially exposing session cookies, defacing content or executing further attacks against site users. The flaw is a classic input validation oversight (CWE‑79).

The vulnerability impacts the BoldGrid Post and Page Builder plugin for WordPress, affecting all versions from the first release up to and including 1.27.5. Users running any of these plugin versions on a WordPress site are susceptible. No other vendors or products are listed as affected.

The CVSS score of 6.5 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of widespread exploitation at present. The flaw is not yet documented in the CISA KEV catalog, but its existence is publicly known and could be leveraged by attackers who can input crafted content into the builder interface. An attacker would typically craft malicious payloads that are stored by the plugin and later rendered in the page, thus executing in the context of any visitor.