CVE-2022-2089: Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site Scripting
Published Jul 11, 2022
·Updated
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed.
Affected Software
1 affected component
Bold-themes Bold Page Builder Wordpress<4.3.3
Event History
Jul 11, 2022
CVE Published
via MITRE·12:57 PM
Data Sourced
via MITRE·12:57 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2089?
The severity of CVE-2022-2089 is considered to be high due to the potential for Cross-Site Scripting attacks.
2
How do I fix CVE-2022-2089?
To fix CVE-2022-2089, update the Bold Page Builder WordPress plugin to version 4.3.3 or later.
3
Who is affected by CVE-2022-2089?
CVE-2022-2089 affects high privilege users such as admins using the Bold Page Builder plugin before version 4.3.3.
4
What type of attack can be performed using CVE-2022-2089?
CVE-2022-2089 can allow high privilege users to perform Cross-Site Scripting (XSS) attacks.
5
What are the consequences of exploiting CVE-2022-2089?
Exploiting CVE-2022-2089 could lead to unauthorized script execution in the context of the user's browser.