PT-2026-20748 · Unknown · Bold Page Builder

Theviper · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-25451

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bold Page Builder versions through 5.6.4

Description The Bold Page Builder software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious code can be injected into web pages, potentially affecting users who view those pages. The issue allows for the execution of arbitrary scripts within the context of a user's browser. The vulnerability is due to insufficient sanitization of user-supplied input when generating web pages. The affected component is the page builder functionality itself.

Recommendations Update Bold Page Builder to a version later than 5.6.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25451

Affected Products

Bold Page Builder

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25451 · Security Note
• https://twitter.com/CVEnew/status/2024411338647150801 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve · Note