Bold Page Builder WordPress plugin: Stored Cross-Site Scripting
Summary
The Bold Page Builder WordPress plugin up to and including version 5.9.11 contains a stored Cross-Site Scripting (XSS) flaw. An authenticated user with content-editing rights can store malicious scripts that run in the browser of anyone who views the affected page, which can enable theft of session data or admin actions if an administrator views it. Exploitation requires a victim to visit the crafted page; the CNA rates the impact on confidentiality, integrity and availability as low.
Affected
- Bold Page Builder plugin (WordPress) versions up to and including 5.9.11
- Required privilege per Patchstack: Contributor (unverified in full)
Fixed in
- Version 5.9.12 (per Patchstack and a secondary source; not yet confirmed against the vendor changelog)
Workaround
- Limit Contributor and Author accounts to trusted staff and review who can add or edit page content.
- Review recently edited pages built with the plugin for unexpected script content.
- Use a web application firewall or virtual patching if updating is delayed.
Exploitation
- No public proof of concept or exploit known (VulDB, OffSeq).
- Not known to be exploited in the wild; not listed in CISA KEV at time of research.
- Data is preliminary; recheck CISA KEV and public exploit sources.
Our recommendation
- Update the Bold Page Builder plugin to version 5.9.12 or later, after verifying the fixed version against the Patchstack advisory.
- Check which WordPress sites use the plugin and who holds Contributor or higher accounts.
- Review pages edited by low-privileged users for injected scripts.
- Prioritise sites with many editor accounts or administrator visitors; patch in the next maintenance window at the latest.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-125455 patchstack.com
- VulDB CVE-2026-125455 vuldb.com
- OffSeq Radar CVE-2026-125455 radar.offseq.com
- Strix CVE-2026-125455 www.strix.ai
- WordPress.org Bold Page Builder plugin wordpress.org
- Patchstack advisory CVE-2026-62110 (earlier issue) patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:41.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.