The Bold Page Builder WordPress plugin has a stored XSS vulnerability caused by the additional_settings parameter. When an authenticated user with contributor‑level access or higher submits content to this parameter, the plugin stores the data without sanitizing or escaping it. Later, when the page is rendered, the script runs in the browser of any visitor, allowing the attacker to deface the site, steal session cookies, or hijack user accounts. The weakness is classified as CWE‑79.

All WordPress installations that use Bold Page Builder version 5.3.6 or older are affected. Versions beyond 5.3.6 contain a fix that sanitizes the additional_settings field. The issue is present in every release up to and including 5.3.6, regardless of other plugin or theme versions.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA KEV. Successful exploitation requires the attacker to be authenticated with contributor‑level privileges and to have permission to edit plugin content. Because the stored malicious code is served to all page visitors, the impact can affect the confidentiality, integrity, and availability of the affected WordPress site.