CVE-2026-84021

A Stored Cross-Site Scripting (XSS) vulnerability exists in the WordPress Bold Page Builder plugin in versions prior to 5.9.8. The plugin does not adequately validate and sanitize URL attributes used in page builder components such as bt_bb_button, bt_bb_headline, and bt_bb_icon.

Authenticated users with Contributor-level privileges can inject malicious JavaScript URLs (e.g., javascript: URI schemes) into shortcode parameters, triggering execution when users interact with the rendered elements.

Bold Page Builder is a visual drag-and-drop page builder widely used across WordPress themes. When building posts, users configure attributes such as button links, icons, and headline destinations. Due to missing sanitization filters on shortcode URL parameters, malicious protocols and inline payloads are preserved and rendered directly into HTML anchor tags without escaping.

Attack vector: Authenticated Contributor post creation using customized shortcodes containing unsanitized URI parameters.

• Arbitrary JavaScript execution when site visitors or admins click affected page builder components
• Potential cookie theft, token extraction, and cross-site scripting exploitation
• Malicious redirection of authenticated users to external phishing sites

Update Bold Page Builder to version 5.9.8 or later. The vendor implemented URL protocol validation and sanitization on all page builder shortcode link handlers.