Skip to content
Noroxi

Bold Page Builder

bold-page-builder · plugin

Known security vulnerabilities for Bold Page Builder. Find out in seconds which version runs on your site with WP Lens.

41 known vulnerabilities

1 exploitable without logging in · latest Sep 30, 2026

Listed on wordpress.org · latest 5.9.10 · last updated Sep 9, 2026 · 40K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-50417login required≤ 5.1.3

    WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability

    High 8.8

  • CVE-2019-15821unauthenticated

    The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.

    High 7.5

  • CVE-2026-25451login required≤ 5.6.9

    WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2025-66057login required≤ 5.5.2

    WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2025-58194login required≤ 5.4.3

    WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2025-54006login required≤ 5.4.1

    WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2025-47488login required≤ 5.3.2

    WordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2026-62110contributor+≤ 5.9.9

    WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-88037contributor+≤ 5.7.2

    Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title

    Medium 6.4

  • CVE-2026-6173contributor+≤ 5.7.2

    Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter

    Medium 6.4

  • CVE-2026-6172contributor+≤ 5.7.2

    Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter

    Medium 6.4

  • CVE-2026-6171contributor+≤ 5.7.2

    Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

    Medium 6.4

  • CVE-2026-6170contributor+≤ 5.7.2

    Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute

    Medium 6.4

  • CVE-2026-5920contributor+≤ 5.9.6

    Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter

    Medium 6.4

  • CVE-2026-2357contributor+≤ 5.6.8

    Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2026-3694contributor+≤ 5.6.8

    Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

    Medium 6.4

  • CVE-2025-15267contributor+≤ 5.6.1

    Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

    Medium 6.4

  • CVE-2025-13463author+≤ 5.5.3

    Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

    Medium 6.4

  • CVE-2025-12803contributor+≤ 5.5.1

    Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

    Medium 6.4

  • CVE-2025-12159contributor+≤ 5.4.8

    Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 6.4

  • CVE-2025-7730contributor+≤ 5.4.5

    Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter

    Medium 6.4

  • CVE-2025-5286contributor+≤ 5.3.6

    Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter

    Medium 6.4

  • CVE-2025-3715contributor+≤ 5.3.5

    Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter

    Medium 6.4

  • CVE-2025-47525high privilege≤ 5.3.0

    WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.9

  • CVE-2024-53801login required≤ 5.2.1

    WordPress Bold Page Builder plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-47298login required≤ 5.1.1

    WordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-47391login required≤ 5.1.1

    WordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-30442login required≤ 4.8.0

    WordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-30179login required≤ 4.7.6

    WordPress Bold Page Builder plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2023-49823login required≤ 4.6.1

    WordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2024-7100contributor+≤ 5.0.2

    Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

    Medium 5.4

  • CVE-2024-2736contributor+≤ 4.8.8

    Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags

    Medium 5.4

  • CVE-2024-2735contributor+≤ 4.8.8

    Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element

    Medium 5.4

  • CVE-2024-2734contributor+≤ 4.8.8

    Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features

    Medium 5.4

  • CVE-2024-2733contributor+≤ 4.8.8

    Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element

    Medium 5.4

  • CVE-2024-3267contributor+≤ 4.8.8

    Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode

    Medium 5.4

  • CVE-2024-3266contributor+≤ 4.8.8

    Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute

    Medium 5.4

  • CVE-2024-1160contributor+≤ 4.8.0

    Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link

    Medium 5.4

  • CVE-2024-1159contributor+≤ 4.8.0

    Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content

    Medium 5.4

  • CVE-2024-1157contributor+≤ 4.8.0

    Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL

    Medium 5.4

  • CVE-2024-54382high privilege≤ 5.1.5

    WordPress Bold Page Builder plugin <= 5.1.5 - Path Traversal vulnerability

    Medium 4.9

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory