The vulnerability is a DOM‑based XSS flaw caused by improper neutralization of user input during web page generation. An attacker can inject malicious scripts that execute in the victim’s browser when a crafted URL or form input is processed by the Bold Page Builder plugin. The impact is limited to the execution of scripts in the victim’s browser, which may allow unauthorized actions within the context of the site’s content.

Any WordPress site that has Bold Page Builder installed on a version up to and including 5.3.2 is affected. This includes all installations where the plugin is active on the server and serves admin or public pages that include the vulnerable code paths.

The CVSS score of 6.5 rates this as a moderate‑severity flaw. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the exploitation of DOM‑based XSS by directing a victim to a specially crafted URL or by submitting malicious input through the plugin’s interface, causing the browser to execute injected script in the page context.