{"id":"CVE-2026-125455","kind":"vulnerability","aliases":["CVE-2026-125455"],"related":[],"title":"Bold Page Builder WordPress plugin: stored XSS through 5.9.11","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.","summary":"Bold Page Builder, a WordPress page-builder plugin from Bold Themes, has a stored cross-site scripting flaw in versions through 5.9.11. An attacker who can save content can plant script that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bold-page-builder","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Bold Page Builder plugin version in the WordPress admin under Plugins.\n- Look for the `bold-page-builder` plugin directory and its version header.","fix":"- Bold Page Builder: versions after `5.9.11` (the sources do not name the exact fixed version).","status":"open","published_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:31+00:00","updated_at":"2026-11-11T12:28:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T12:28:31Z","model":"claude-haiku-5-5","output":{"fix":"- Bold Page Builder: versions after `5.9.11` (the sources do not name the exact fixed version).","reach":"internet","title":"Bold Page Builder WordPress plugin: stored XSS through 5.9.11","impact":"medium","summary":"Bold Page Builder, a WordPress page-builder plugin from Bold Themes, has a stored cross-site scripting flaw in versions through 5.9.11. An attacker who can save content can plant script that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bold-page-builder","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers and steals sessions or data.","analyst_note":"Confirm the fixed version and the required privilege level from the vendor advisory or the WordPress plugin changelog.","how_to_check":"- Check the installed Bold Page Builder plugin version in the WordPress admin under Plugins.\n- Look for the `bold-page-builder` plugin directory and its version header.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Bold Page Builder plugin at version 5.9.11 or earlier are exposed. The sources do not say which roles can store the injected content, so sites that let untrusted users edit pages are the most at risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4553,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125455':12A,15A '-2026':11A,14A '5.9.11':9A,48B,98C 'affect':91C 'allow':87C 'attack':50B 'bold':1A,17B,25B,35B,78C,80C,84C,92C 'bold-page-build':16B,83C 'browser':63B 'builder':3A,19B,27B,32B,82C,86C,94C 'content':54B 'cross':41B,73C 'cross-sit':40B,72C 'cve':10A,13A 'flaw':44B 'generat':71C 'host':23B 'improp':64C 'input':67C 'issu':90C 'n/a':96C 'neutral':65C 'packag':20B 'page':2A,18B,26B,31B,70C,81C,85C,93C 'page-build':30B 'plant':56B 'plugin':5A,33B 'run':59B 'save':53B 'script':43B,57B,75C 'self':22B 'self-host':21B 'site':42B,74C 'store':6A,39B,88C 'theme':36B,79C 'version':46B 'visitor':62B 'vulner':76C 'web':69C 'wordpress':4A,24B,29B 'xss':7A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bold Page Builder plugin at version 5.9.11 or earlier are exposed. The sources do not say which roles can store the injected content, so sites that let untrusted users edit pages are the most at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["boldpagebuilder","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125455':12A,15A '-2026':11A,14A '5.9.11':9A 'bold':1A 'builder':3A 'cve':10A,13A 'page':2A 'plugin':5A 'store':6A 'wordpress':4A 'xss':7A","search_b":"'5.9.11':48B 'attack':50B 'bold':17B,25B,35B 'bold-page-build':16B 'browser':63B 'builder':19B,27B,32B 'content':54B 'cross':41B 'cross-sit':40B 'flaw':44B 'host':23B 'packag':20B 'page':18B,26B,31B 'page-build':30B 'plant':56B 'plugin':33B 'run':59B 'save':53B 'script':43B,57B 'self':22B 'self-host':21B 'site':42B 'store':39B 'theme':36B 'version':46B 'visitor':62B 'wordpress':24B,29B","search_c":"'5.9.11':98C 'affect':91C 'allow':87C 'bold':78C,80C,84C,92C 'bold-page-build':83C 'builder':82C,86C,94C 'cross':73C 'cross-sit':72C 'generat':71C 'improp':64C 'input':67C 'issu':90C 'n/a':96C 'neutral':65C 'page':70C,81C,85C,93C 'script':75C 'site':74C 'store':88C 'theme':79C 'vulner':76C 'web':69C 'xss.this':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125455","severity":null,"published_at":"2026-11-11T12:19:49+00:00","modified_at":"2026-11-11T12:19:50+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}