The Bold Page Builder plugin for WordPress allows an authenticated contributor or higher to inject arbitrary JavaScript through the unsanitized 'text' attribute of the bt_bb_button shortcode, resulting in stored cross‑site scripting that will execute whenever a page containing the shortcode is viewed. This flaw, identified as CWE‑79, can lead to session hijacking, defacement, or credential theft for any site visitor.

Any WordPress installation using Bold Page Builder by BoldThemes that has a version up to and including 5.6.8 is affected; the vulnerability applies to all installations that have the plugin enabled and any user who can edit or create content with contributor or higher privileges.

With a CVSS score of 6.4 the vulnerability is classified as medium severity, and no EPSS data or KEV listing is available, indicating a moderate exploitation probability. The likely attack vector requires an authenticated contributor+ user to add or edit a page that contains the problematic shortcode; once the malicious script is stored it will persist and affect all users who view the compromised page.