CVE-2026-84021
Received Received - Intake

Bold Page Builder WordPress Plugin Reflected Cross-Site Scripting

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-84021
EUVD
EUVD-2026-71860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bold_page_builder plugin to 5.9.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin before version 5.9.8. It allows users with the Contributor role or higher to inject malicious scripts via URL parameters in specific components like buttons, headlines, or icons. The plugin fails to properly validate link URLs before outputting them in HTML attributes, and a security filter can be bypassed.

Detection Guidance

Check WordPress plugin versions for Bold Page Builder. Run: wp plugin list | grep bold-page-builder. If version is below 5.9.8, the system is vulnerable.

Impact Analysis

An attacker could inject malicious scripts that execute when a user clicks an affected link. This could lead to unauthorized actions on behalf of the user, theft of sensitive data, or defacement of the website. Users with Contributor roles or higher could exploit this to compromise the site.

Compliance Impact

This vulnerability could lead to data breaches, exposing user data and violating privacy regulations like GDPR or HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust. Website operators must address this to maintain regulatory compliance.

Mitigation Strategies

Update the Bold Page Builder plugin to version 5.9.8 or later immediately. Remove or disable the plugin if updates are not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart