The Bold Page Builder WordPress plugin versions earlier than 5.9.8 allow contributors and higher to insert arbitrary JavaScript by not sanitising and escaping several shortcode attributes before rendering them in HTML attributes. This leads to a stored cross‑site scripting vulnerability that can be triggered when other site visitors view the affected page, potentially enabling phishing, defacement, or theft of user credentials.

WordPress installations that have Bold Page Builder installed with any version lower than 5.9.8 are affected. Any user with a Contributor role or higher on these sites can exploit the flaw. No specific patch versions are listed beyond the <5.9.8 threshold, so all earlier releases remain vulnerable until updated.

The CVSS base score of 6.8 indicates a moderate severity. The EPSS score of less than 1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in CISA KEV, meaning there are no known active exploitation campaigns. The attack vector likely involves normal site editing or content creation by a contributor or higher‑privileged user, after which the compromised script runs for any visitor who loads the page.