The Bold Page Builder plugin contains an insufficiently sanitized data‑text parameter that allows a malicious user to store arbitrary web scripts. An authenticated contributor or higher can embed JavaScript into page content; the script executes whenever a visitor loads the affected page, enabling cookie theft, session hijacking, defacement or other malicious actions. The weakness is a classic input‑validation failure identified as CWE‑79.

WordPress sites using the Bold Page Builder plugin from the vendor Boldthemes. All versions up to and including 5.3.5 are affected; newer releases after 5.3.5 have addressed the issue.

The CVSS score of 6.4 categorises the flaw as moderate severity. The EPSS score of less than 1 % indicates a low probability of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalogue. Attackers need only authenticated Contributor‑level access and the ability to edit page elements; no remote code execution is required. The attack vector is likely through the front‑end editing interface where the data‑text parameter is submitted, so the risk is modest but remains significant for any user who can create or modify pages.