CVE-2026-84022: Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

Q: Who can exploit this issue?

A WordPress user with the Contributor role or any higher-privileged role can exploit it by supplying malicious script content through affected shortcode element attributes.

Q: When does the injected script execute?

The script executes when another user views a page containing the attacker-controlled shortcode content.

Q: Which installations are affected?

Installations using Bold Page Builder versions earlier than 5.9.8 are affected.

Published Sep 5, 2026

Updated

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

Affected Software

1 affected component

Bold Bold Page Builder<5.9.8

Event History

Sep 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A WordPress user with the Contributor role or any higher-privileged role can exploit it by supplying malicious script content through affected shortcode element attributes.

When does the injected script execute?

The script executes when another user views a page containing the attacker-controlled shortcode content.

Which installations are affected?

Installations using Bold Page Builder versions earlier than 5.9.8 are affected.