CVE-2025-15267: Bold Page Builder WordPress XSS Flaw

CVE-2025-15267 Overview

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.5.7. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with contributor-level privileges can inject persistent malicious scripts that execute in the browsers of all users who view affected pages, potentially leading to session hijacking, credential theft, and site defacement.

Affected Products

• Bold Page Builder plugin for WordPress versions up to and including 5.5.7
• WordPress sites utilizing the bt_bb_accordion_item shortcode functionality

Discovery Timeline

• 2026-02-07 - CVE CVE-2025-15267 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-15267

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the bt_bb_accordion_item shortcode handler of the Bold Page Builder plugin. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating a failure to properly sanitize user-controlled input before rendering it in the browser.

The attack is network-accessible and requires low privileges (contributor-level access) with no user interaction required for the initial injection. The scope is changed, meaning the vulnerable component impacts resources beyond its security scope—specifically, scripts injected by an attacker execute in the context of other users' browser sessions. This can lead to limited confidentiality and integrity impacts as attackers can access session data and modify page content for affected users.

Root Cause

The root cause lies in the bt_bb_accordion_item.php file where user-supplied attributes are processed without adequate input sanitization and output escaping. When rendering shortcode attributes, the plugin fails to properly encode special characters that could be interpreted as HTML or JavaScript, allowing attackers to inject executable code that persists in the WordPress database and renders on every page load.

Attack Vector

The attack vector requires an authenticated user with at least contributor-level privileges on the WordPress site. The attacker crafts a malicious shortcode using the bt_bb_accordion_item element with specially crafted attribute values containing JavaScript payloads. When this content is saved and subsequently viewed by any user (including administrators), the injected script executes within their browser session.

The vulnerable code path can be examined in the WordPress Plugin Source Code at line 28, where attribute handling occurs without proper escaping. The malicious payload persists in the database and triggers each time the affected page loads, making this a stored XSS variant with broader impact than reflected XSS attacks.

Detection Methods for CVE-2025-15267

Indicators of Compromise

• Unexpected JavaScript code or suspicious event handlers within bt_bb_accordion_item shortcode attributes in WordPress post content
• Unusual network requests originating from pages containing Bold Page Builder accordion elements
• Reports from users experiencing unexpected behavior or redirects when viewing specific pages
• Presence of encoded script content (such as base64 or URL-encoded payloads) in shortcode parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS patterns in POST requests to WordPress admin endpoints
• Deploy SentinelOne Singularity to monitor for malicious script execution patterns indicative of XSS exploitation
• Utilize WordPress security plugins to scan database content for suspicious shortcode attributes and potential XSS payloads
• Monitor WordPress audit logs for content modifications by contributor-level users that contain script-like patterns

Monitoring Recommendations

• Enable detailed logging for WordPress post creation and modification activities, particularly for users with contributor roles
• Configure browser Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Implement real-time alerting for database queries that insert or modify content containing JavaScript event handlers or script tags
• Review SentinelOne's behavioral AI alerts for any anomalous client-side script execution patterns on WordPress-hosted pages

How to Mitigate CVE-2025-15267

Immediate Actions Required

• Update the Bold Page Builder plugin to a version newer than 5.5.7 that contains the security fix
• Audit existing pages and posts for any suspicious content within bt_bb_accordion_item shortcodes and remove malicious payloads
• Review user accounts with contributor-level access or higher for any unauthorized activity
• Consider temporarily disabling the Bold Page Builder plugin until the patch can be applied if immediate updates are not possible

Patch Information

Users should update the Bold Page Builder plugin to the latest available version through the WordPress plugin repository. The security fix addresses the insufficient input sanitization and output escaping in the bt_bb_accordion_item shortcode handler. Review the Wordfence Vulnerability Analysis for additional details on the vulnerability and remediation guidance.

Workarounds

• Restrict contributor-level access to trusted users only until the plugin can be updated
• Implement Content Security Policy (CSP) headers with strict script-src directives to mitigate the impact of injected scripts
• Use WordPress security plugins to filter and sanitize shortcode attributes at the application level
• Temporarily disable the bt_bb_accordion_item shortcode functionality if it is not essential to site operations

# Add Content Security Policy header to WordPress via .htaccess
# This helps mitigate XSS impact by restricting script sources
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"