CVE-2025-13463: Bold Page Builder for WordPress XSS Flaw

CVE-2025-13463 Overview

The Bold Page Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Post Grid component affecting all versions up to and including 5.5.3. The vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access or above to inject arbitrary web scripts into pages. These malicious scripts execute whenever any user accesses the compromised page, potentially leading to session hijacking, credential theft, or further attacks against site visitors.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the browsers of all users who view the affected page, enabling session theft, defacement, and phishing attacks.

Affected Products

• Bold Page Builder for WordPress versions up to and including 5.5.3
• WordPress sites using the vulnerable Post Grid component
• Any WordPress installation with the Bold Page Builder plugin enabled

Discovery Timeline

• 2026-02-07 - CVE CVE-2025-13463 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-13463

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability resides in the Post Grid component (bt_bb_css_post_grid) of the Bold Page Builder plugin. The core issue is the failure to properly sanitize user-supplied input and escape output when rendering content within the Post Grid element. When an authenticated user with at least Author privileges creates or edits a page using the Bold Page Builder, they can inject malicious JavaScript code through the Post Grid component's input fields. This injected script is then stored in the database and executed in the browsers of any visitor who views the page.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a common weakness in web applications where user input is not properly validated before being included in dynamically generated web pages.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping within the bt_bb_css_post_grid component. The affected code paths in both the JavaScript handler (bt_bb_css_post_grid.js) and PHP renderer (bt_bb_css_post_grid.php) fail to properly sanitize user-controlled data before rendering it to the page. Specifically, the plugin does not adequately filter HTML special characters or enforce proper encoding when user input is reflected in the page output, allowing script tags and event handlers to be injected and executed.

Attack Vector

The attack requires network access and authenticated Author-level privileges on the target WordPress site. An attacker who has obtained or been granted Author access can exploit this vulnerability by:

1. Creating or editing a page using Bold Page Builder
2. Adding a Post Grid component to the page
3. Injecting malicious JavaScript payload into vulnerable input fields
4. Publishing or updating the page

Once the malicious content is saved, the stored XSS payload executes in the browser of any user who views the page, including administrators. This can lead to session hijacking, administrative account takeover, or the spread of malware to site visitors.

The vulnerability mechanism involves improperly sanitized input being stored in the WordPress database and later rendered without proper escaping. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis and the affected source code at bt_bb_css_post_grid.php.

Detection Methods for CVE-2025-13463

Indicators of Compromise

• Unexpected JavaScript code or <script> tags within Post Grid component content in the WordPress database
• Suspicious page edits by Author-level users containing encoded or obfuscated JavaScript
• Browser console errors or unexpected network requests to external domains when viewing pages built with Bold Page Builder
• User reports of unusual behavior, redirects, or pop-ups when accessing specific pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in POST requests to the WordPress admin interface
• Monitor WordPress audit logs for page creation or modification events by Author-level users, particularly those involving Bold Page Builder components
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution violations
• Use WordPress security plugins to scan for known malicious JavaScript patterns in page content

Monitoring Recommendations

• Enable comprehensive logging for all content modifications in WordPress, especially for page builder plugins
• Configure alerts for pages containing potential XSS indicators such as <script>, javascript:, or event handler attributes like onerror
• Regularly audit user accounts with Author or higher privileges for unauthorized access
• Monitor outbound network traffic for connections to unknown external domains that may indicate data exfiltration

How to Mitigate CVE-2025-13463

Immediate Actions Required

• Update the Bold Page Builder plugin to a version newer than 5.5.3 that contains the security fix
• Review all pages created with Bold Page Builder Post Grid components for malicious script injections
• Audit Author-level and above user accounts for unauthorized or suspicious activity
• Consider temporarily disabling the Bold Page Builder plugin until patching is complete if the site is at high risk

Patch Information

Organizations should update the Bold Page Builder plugin to the latest patched version available through the WordPress plugin repository. The vulnerability affects all versions up to and including 5.5.3. Check the WordPress Plugin Directory for the latest release that addresses this vulnerability. After updating, verify the plugin version in the WordPress admin panel under Plugins.

Workarounds

• Restrict Author-level access to only trusted users until the plugin is patched
• Implement a Web Application Firewall with XSS detection rules to filter malicious input
• Enable Content Security Policy headers with strict script-src directives to prevent inline script execution
• Temporarily disable the Post Grid component or the entire Bold Page Builder plugin if immediate patching is not feasible

# Add Content Security Policy header in Apache .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# Or in nginx configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;