CVE-2026-125680: WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

Bold Page Builder versions through 5.9.11 are affected. The available data does not identify a fixed version or any configuration-specific limitation.

Q: What level of access does an attacker need?

The vector indicates network-reachable exploitation with low privileges required and user interaction required. An attacker must have some authenticated low-privilege access and must induce a user to interact with the injected content.

Q: What is the likely impact of successful exploitation?

This is a stored XSS issue. The supplied vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Bold Page Builder to a version that resolves this vulnerability.
Fixed in 5.9.12

Event History

Nov 11, 2026

CVE Published

via MITRE·11:57 AM

Data Sourced

via MITRE·11:57 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Bold Page Builder versions through 5.9.11 are affected. The available data does not identify a fixed version or any configuration-specific limitation.

What level of access does an attacker need?

The vector indicates network-reachable exploitation with low privileges required and user interaction required. An attacker must have some authenticated low-privilege access and must induce a user to interact with the injected content.

What is the likely impact of successful exploitation?