WordPress plugin
Bold Page Builder security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium45
- Low1
All Bold Page Builder vulnerabilities
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.11Update to 5.9.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.11Update to 5.9.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
≤5.9.6Update to 5.9.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.9Update to 5.9.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<5.9.9Update to 5.9.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<5.9.8Update to 5.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<5.9.8Update to 5.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.8Update to 5.6.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
≤5.6.8Update to 5.6.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤5.9.6Update to 5.9.7
- Medium6.4Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid
≤5.6.3Update to 5.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode
≤5.5.3Update to 5.5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode
≤5.6.1Update to 5.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.9Update to 5.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.5.2Update to 5.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
≤5.4.5Update to 5.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.3Update to 5.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.1Update to 5.4.2
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter
≤5.3.6Update to 5.3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
≤5.3.5Update to 5.3.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.3.0Update to 5.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.3.2Update to 5.3.3
- Low2.7Authenticated (Editor+) Path Traversal
≤5.1.5Update to 5.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.2.1Update to 5.2.2
- Medium4.3Missing Authorization
≤5.1.3Update to 5.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.1.0Update to 5.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.1.1Update to 5.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
≤5.0.2Update to 5.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element
≤4.8.8Update to 4.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features
≤4.8.8Update to 4.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
≤4.8.8Update to 4.8.9
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element
≤4.8.8Update to 4.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute
≤4.8.8Update to 4.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode
≤4.8.8Update to 4.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via class
≤4.7.6Update to 4.7.7
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link
≤4.8.0Update to 4.8.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
≤4.8.0Update to 4.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content
≤4.8.0Update to 4.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.6.1Update to 4.7.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
<4.3.3Update to 4.3.3
- High7.5PHP Object Injection
≤3.1.5Update to 3.1.6
- High7.5Missing Authorization to Settings Update
≤2.3.1Update to 2.3.2
Bold Page Builder: common questions
Does Bold Page Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 48 known vulnerabilities in Bold Page Builder: 2 high, 45 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Bold Page Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Bold Page Builder vulnerability?
CVE-2026-125680, published Nov 11, 2026: Bold Page Builder <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Bold Page Builder vulnerability listed in CISA KEV?
No. None of the known Bold Page Builder vulnerabilities is currently listed in the CISA KEV catalog.