CVE-2025-12159: Bold Page Builder WordPress XSS Flaw

CVE-2025-12159 Overview

CVE-2025-12159 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress. The flaw affects all versions up to and including 5.4.8. It exists in the plugin's bt_bb_raw_content shortcode, which fails to properly sanitize input and escape output on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page. The issue is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in visitor browsers, enabling session theft, account takeover, and content redirection.

Affected Products

Bold Page Builder plugin for WordPress, all versions through 5.4.8
WordPress sites permitting contributor-level account registration
Sites using the bt_bb_raw_content shortcode in published content

Discovery Timeline

2026-02-07 - CVE-2025-12159 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12159

Vulnerability Analysis

The vulnerability resides in the bt_bb_raw_content shortcode handler shipped with the Bold Page Builder plugin. The handler accepts user-controlled attributes and renders them into page output without sufficient sanitization or escaping. An authenticated user with contributor permissions can craft a post or page containing the shortcode with malicious attribute values. When an administrator, editor, or site visitor loads the rendered page, the browser executes the attacker-controlled script in the site origin.

Stored XSS in a page builder context is impactful because content saved through the shortcode persists in the database. Each subsequent page view re-triggers the payload until the malicious content is removed. Attackers can use this to hijack authenticated administrator sessions, exfiltrate cookies, or perform actions on behalf of higher-privilege users through forged requests.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes processed by bt_bb_raw_content.php. The plugin treats user-supplied attributes as trusted content and emits them into the HTML response without applying WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses(). The relevant rendering logic is documented in the WordPress Plugin Code Reference.

Attack Vector

Exploitation requires an authenticated WordPress account with at least contributor capabilities. The attacker creates or edits a post that embeds the bt_bb_raw_content shortcode with crafted attributes containing JavaScript. Once the post is rendered, the payload executes in the context of every viewer's session. Additional technical detail is available in the Wordfence Vulnerability Report.

The vulnerability manifests through unsanitized shortcode attribute handling. No verified exploit code is published. Defenders should consult the linked references for full technical context.

Detection Methods for CVE-2025-12159

Indicators of Compromise

Posts or pages containing the bt_bb_raw_content shortcode with attribute values that include <script>, onerror=, onload=, or javascript: strings.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin-rendered pages.
New administrator accounts, modified user roles, or plugin installations following contributor activity.

Detection Strategies

Query the wp_posts table for content matching the pattern bt_bb_raw_content combined with HTML event handler attributes or script tags.
Review WordPress audit logs for contributor-level users creating or editing posts that use page builder shortcodes.
Inspect rendered HTML of public pages for inline JavaScript that references unfamiliar external resources.

Monitoring Recommendations

Enable a WordPress activity logging plugin and forward events to a centralized log platform for correlation.
Monitor file integrity for the bold-page-builder plugin directory to identify unexpected modifications.
Alert on creation of new contributor or higher accounts that subsequently publish content containing raw shortcodes.

How to Mitigate CVE-2025-12159

Immediate Actions Required

Update the Bold Page Builder plugin to a version above 5.4.8 once the vendor publishes a patched release.
Audit existing contributor, author, and editor accounts and remove any that are unused or unverified.
Search all post content for the bt_bb_raw_content shortcode and review attribute values for malicious payloads.

Patch Information

No fixed version is listed in the available CVE references at publication time. Administrators should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for updates beyond version 5.4.8.

Workarounds

Restrict contributor-level registration and require manual approval for new accounts that can author content.
Deactivate the Bold Page Builder plugin until a patched release is available if the shortcode is not essential to site operation.
Deploy a Web Application Firewall (WAF) rule that blocks shortcode attributes containing script tags or JavaScript event handlers.

bash

# Search WordPress database for vulnerable shortcode usage
wp db query "SELECT ID, post_title, post_status FROM wp_posts \
  WHERE post_content LIKE '%bt_bb_raw_content%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');"