The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor contains a stored XSS flaw that occurs when the Table Designer 'data-label' attribute is not properly sanitized or escaped. Attackers with Contributor level or higher can place arbitrary JavaScript code into that attribute, causing the code to run whenever any user opens the affected page. This weakness allows arbitrary script execution in the victim’s browser, potentially enabling session hijacking, data theft, or defacement.

All installations of the Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin running version 1.27.13 or earlier are vulnerable. The plugin is used in WordPress sites that employ the drag‑and‑drop editor for page construction.

The affected vulnerability has a CVSS score of 6.4, indicating a moderate severity. Because the attack requires authenticated access with Contributor or higher privileges, the attack surface is limited to trusted users of a WordPress site. Exploit probability is unknown due to missing EPSS information, and the issue is not listed in the CISA KEV catalog. If an attacker gains the necessary role, they can add malicious scripts and compromise the confidentiality and integrity of site content, and potentially affect availability by injecting malicious redirects. Given the potential impact on user sessions, the vulnerability should be treated as high priority.