The vulnerability allows an authenticated user with the Contributor role or higher to insert malicious JavaScript into a link attribute, which executes when a site visitor clicks the link. This stored cross‑site scripting can result in the execution of arbitrary code in the context of other users, enabling cookie theft, phishing, or content tampering. The CVSS score of 6.8 indicates a moderate severity level. The EPSS score of less than 1% suggests a low current probability of exploitation, and the flaw is not listed in the CISA KEV catalog.

Bold Page Builder plugin for WordPress, versions 5.9.7 and earlier, is affected. Only users with Contributor role or higher who can edit plugin content are at risk. Based on the supplied data, it is inferred that the flaw appears to be confined to the Bold Page Builder plugin itself and does not directly impact other WordPress core components or plugins.

The vulnerability allows an authenticated user with the Contributor role or higher to insert malicious JavaScript into a link attribute, which executes when a site visitor clicks the link. This stored cross‑site scripting can result in the execution of arbitrary code in the context of other users, enabling cookie theft, phishing, or content tampering. The CVSS score of 6.8 indicates a moderate severity level. The EPSS score of less than 1% suggests a low current probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker does not require advanced network techniques such as VPNs; having edit rights to the WordPress editor is sufficient. The likely exploitation path involves the attacker editing content and then convincing other users to click the malicious link.