GCVE - cpe:2.3:a:unknown:bold_page_builder:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:bold_page_builder:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Bold Page Builder (`b2c469f0-3bca-5f71-847d-25b219997b95`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-84022`	vulnerable	2026-09-16 04:33:10.442910	Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page. Published: 2026-09-05T06:00:07.996Z Updated: 2026-09-06T10:38:07.650Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/53bbe80c-caea-4893-82a6-03e5173390de/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-84028`	vulnerable	2026-09-16 04:33:10.417935	Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page. Published: 2026-09-06T06:00:04.445Z Updated: 2026-09-06T10:44:40.807Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/6abd5d49-af3a-4515-ba33-57b56a9fba4e/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-84021`	vulnerable	2026-09-16 04:33:10.310261	Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link. Published: 2026-09-05T06:00:07.815Z Updated: 2026-09-06T10:38:22.610Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/ca226eab-59a2-42d5-96f6-84dacf7c6c5a/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2089`	vulnerable	2026-06-08 05:42:50.244709	Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site Scripting The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. Published: 2022-07-11T12:57:15.000Z Updated: 2024-08-03T00:24:44.232Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/9fe7e9d5-7bdf-4ade-9a3c-b4af863fa4e8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24579`	vulnerable	2026-06-08 05:30:38.802978	Bold Page Builder < 3.1.6 - PHP Object Injection The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases. Published: 2021-08-30T14:11:21.000Z Updated: 2024-08-03T19:35:20.209Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/08edce3f-2746-4886-8439-76e44ec76fa8	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.