CVE-2025-12159: Bold Page Builder WordPress XSS Vulnerability

CVE-2025-12159 Overview

The Bold Page Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the bt_bb_raw_content shortcode. This security flaw affects all versions up to and including 5.4.8 and stems from insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into WordPress pages, which execute whenever any user views the compromised page.

Critical Impact

Attackers with contributor-level privileges can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of legitimate users.

Affected Products

• Bold Page Builder plugin for WordPress versions up to and including 5.4.8
• WordPress installations using affected Bold Page Builder versions
• Websites with contributor-level or higher user accounts using the vulnerable plugin

Discovery Timeline

• 2026-02-07 - CVE CVE-2025-12159 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-12159

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability resides in the Bold Page Builder plugin's bt_bb_raw_content shortcode functionality. The core issue is that the plugin fails to properly sanitize and escape user-supplied attribute values before rendering them in the HTML output. When a user with contributor-level access creates or edits content using the bt_bb_raw_content shortcode, malicious JavaScript can be embedded within the shortcode attributes. This payload is then stored in the WordPress database and served to all subsequent visitors of the affected page.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which is the standard classification for Cross-Site Scripting vulnerabilities. The attack surface is network-accessible, requiring low complexity to exploit, and the impact crosses security boundaries as the injected scripts execute in the context of other users' browser sessions.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping within the bt_bb_raw_content.php file. The plugin processes user-supplied shortcode attributes without adequately filtering or encoding special characters that could be interpreted as HTML or JavaScript by the browser. Specifically, the shortcode handler at line 25 of the affected file does not implement proper WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses() when outputting user-controlled data.

Attack Vector

The attack requires an authenticated user with at least contributor-level privileges to access the WordPress post editor. The attacker crafts a malicious shortcode using bt_bb_raw_content with specially crafted attribute values containing JavaScript payloads. Once the page containing the malicious shortcode is published or saved, any user who views the page—including administrators—will have the injected script execute in their browser context.

The attack can be leveraged for various malicious purposes including:

• Stealing session cookies to hijack administrator accounts
• Redirecting users to phishing or malware distribution sites
• Defacing website content dynamically
• Performing actions on behalf of authenticated users
• Capturing keystrokes or form data from visitors

Technical details of the vulnerable code path can be found in the WordPress Plugin Code Review.

Detection Methods for CVE-2025-12159

Indicators of Compromise

• Unexpected JavaScript code or <script> tags within post content containing bt_bb_raw_content shortcodes
• Database entries in wp_posts or wp_postmeta tables containing suspicious encoded payloads within shortcode attributes
• User reports of unexpected browser behavior, redirects, or pop-ups when viewing specific pages
• Audit logs showing contributor-level users creating or modifying pages with unusual shortcode content

Detection Strategies

• Implement WordPress content scanning to detect malicious JavaScript patterns within shortcode attributes in stored posts
• Enable and monitor WordPress audit logging for content modifications by contributor-level users
• Deploy Web Application Firewall (WAF) rules to detect common XSS payloads in POST requests to the WordPress editor
• Use SentinelOne Singularity platform to monitor for suspicious JavaScript execution patterns and DOM manipulation attempts

Monitoring Recommendations

• Review WordPress user accounts with contributor or higher privileges and enforce least privilege access
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Monitor server access logs for unusual patterns of page access following content updates
• Configure alerting for modifications to pages using Bold Page Builder shortcodes

How to Mitigate CVE-2025-12159

Immediate Actions Required

• Update the Bold Page Builder plugin to a patched version higher than 5.4.8 immediately
• Audit existing WordPress content for any instances of bt_bb_raw_content shortcodes with suspicious attribute values
• Review and restrict user accounts with contributor-level access or higher
• Implement Content Security Policy headers to reduce XSS impact while patching is underway

Patch Information

Organizations should update the Bold Page Builder plugin to the latest available version that addresses this vulnerability. The patch implements proper input sanitization and output escaping for the bt_bb_raw_content shortcode attributes. Plugin updates can be applied through the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI using wp plugin update bold-page-builder. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Bold Page Builder plugin if immediate patching is not possible
• Remove contributor-level and author-level user access until the plugin is updated
• Implement server-side input filtering using a WAF to block common XSS patterns in POST data
• Add custom output escaping filters for the bt_bb_raw_content shortcode if plugin modification is feasible

# Disable Bold Page Builder via WP-CLI as temporary mitigation
wp plugin deactivate bold-page-builder

# Scan database for potentially malicious content in shortcodes
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%bt_bb_raw_content%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror%' OR post_content LIKE '%onload%')"