The vulnerability is a stored Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation in the Bold Page Builder plugin. An attacker who can inject content into a page can have malicious scripts executed in the browsers of any user who views that content. This can lead to credential theft, session hijacking, defacement, or other malicious actions within the context of the WordPress site. The weakness maps to CWE‑79, representing inadequate input validation or escaping of data destined for HTML output.

Bold Page Builder for WordPress, version 5.4.3 and earlier, is impacted. The vendor identified is Bold Themes. The vulnerability affects all installations that use the plugin without the patch, regardless of other security controls.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that there is currently very low but nonzero exploitation activity. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector involves using the plugin’s content editing interface to store malformed script tags, meaning that an attacker with writing privileges or a compromised account could leverage this flaw. While the low EPSS reduces the likelihood of widespread public exploitation, administrators should still treat the flaw as a moderate risk until the plugin is updated or mitigated.