PT-2026-20748 · Unknown · Bold Page Builder

Theviper · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2026-25451

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bold Page Builder versions through 5.6.4

Description The Bold Page Builder software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious code can be injected into web pages, potentially affecting users who view those pages. The issue allows for the execution of arbitrary scripts within the context of a user's browser. The vulnerability is due to insufficient sanitization of user-supplied input when generating web pages. The affected component is the page builder functionality itself.

Recommendations Update Bold Page Builder to a version later than 5.6.4.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-25451

Produtos afetados

Bold Page Builder

Referências · 3

• https://twitter.com/CVEnew/status/2024411338647150801 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25451 · Nota de Segurança
• https://patchstack.com/database/Wordpress/Plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota