Bold Page Builder: Stored cross-site scripting (XSS) in WordPress plugin

Summary

The WordPress plugin Bold Page Builder up to and including version 5.9.11 does not properly neutralize user input, which allows stored cross-site scripting (XSS). An attacker with a Contributor-level or higher account can store malicious scripts in content. The script runs when a privileged user, such as an editor or administrator, or a visitor opens the affected page and interacts with it, which can lead to data theft or account hijacking.

Affected

• Bold Page Builder plugin (WordPress), versions up to and including 5.9.11
• Required privilege: Contributor (per Patchstack)

Fixed in

• Update to Bold Page Builder 5.9.12 or later (per Patchstack and the CVE record)

Workaround

• Unknown. No vendor workaround found.
• Until the update is applied, limit Contributor-level and higher accounts to trusted users and review recently edited pages that use Bold Page Builder.

Exploitation

• Patchstack rates the issue as low priority and considers exploitation unlikely.
• No evidence of active exploitation found.
• CISA KEV: not listed (secondary source only).
• No public proof of concept found.

Our recommendation

• Update the Bold Page Builder plugin to version 5.9.12 or later.
• Check which WordPress accounts have Contributor or higher rights and remove unneeded accounts.
• Review recently published or edited content for unexpected scripts.
• Monitor the site for unusual admin activity after the update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OffSeq Radar: CVE-2026-125680 radar.offseq.com
• Strix CVE record CVE-2026-125680 www.strix.ai
• VulDB entry CVE-2026-125455 (same description, possible duplicate) vuldb.com
• Patchstack advisory for earlier issue CVE-2026-62110 (<=5.9.9) patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:37.