CVE-2025-5286: Bold Page Builder WordPress XSS Vulnerability

CVE-2025-5286 Overview

CVE-2025-5286 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Bold Page Builder plugin for WordPress. The flaw affects all versions up to and including 5.3.6. It resides in the handling of the additional_settings parameter within the bt_bb_content_slider content element. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page.

Critical Impact
Authenticated attackers with Contributor privileges can persist arbitrary JavaScript into published pages, enabling session theft, administrative account takeover, and drive-by redirection when other users visit the compromised content.

Affected Products

Bold Page Builder plugin for WordPress, versions up to and including 5.3.6
Fixed in Bold Page Builder version 5.3.7
WordPress sites running the vulnerable bt_bb_content_slider content element

Discovery Timeline

2025-05-29 - CVE-2025-5286 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5286

Vulnerability Analysis

The vulnerability exists in the bt_bb_content_slider.php file of the Bold Page Builder plugin. The additional_settings parameter is passed from a shortcode attribute into rendered HTML output without adequate sanitization or escaping. Because Contributor-level users in WordPress can author draft content containing shortcodes, they can supply attacker-controlled values that render as HTML and JavaScript when the page is viewed.

Stored XSS in a page builder shortcode is particularly impactful. The malicious payload persists in the post content and executes for any visitor, including administrators reviewing pending submissions. An attacker can chain the flaw to steal authenticated session cookies, forge REST API requests, create new administrator accounts, or install additional plugins.

Root Cause

The root cause is missing input sanitization on the additional_settings shortcode attribute and missing output escaping when that value is emitted into the page markup. WordPress provides functions such as sanitize_text_field(), esc_attr(), and esc_html() for these boundaries. The vulnerable revisions of bt_bb_content_slider.php do not apply them to this parameter. See the plugin source at WordPress Plugin Code Line 156 and WordPress Plugin Code Line 176.

Attack Vector

An authenticated attacker with Contributor or higher privileges creates or edits a post containing the bt_bb_content_slider shortcode. The attacker supplies a crafted additional_settings attribute value containing HTML event handlers or <script> tags. When the post is previewed, submitted for review, or published, the payload is stored in the WordPress database. Any subsequent visitor renders the malicious script in the context of the site's origin.

The vendor fix in version 5.3.7 is visible in WordPress Plugin Changeset #3302452 and the corrected source at WordPress Plugin Code Line 156 (v5.3.7).

Detection Methods for CVE-2025-5286

Indicators of Compromise

WordPress wp_posts rows containing [bt_bb_content_slider ... additional_settings="..."] with <script>, onerror=, onload=, or javascript: substrings inside the attribute value
New administrator accounts created shortly after a Contributor user submitted or edited a page that renders the slider element
Outbound requests from visitor browsers to unknown domains sourced from pages rendering the bt_bb_content_slider shortcode

Detection Strategies

Query the WordPress database for shortcode attributes containing HTML tags or JavaScript URI schemes inside additional_settings.
Review plugin version reporting across managed WordPress sites and flag any instance at 5.3.6 or earlier.
Correlate Contributor-role post edits with subsequent privilege changes in the wp_users and wp_usermeta tables.

Monitoring Recommendations

Enable WordPress audit logging to capture post revisions, role changes, and plugin installations.
Forward web server access logs and WordPress application logs to a centralized analytics platform for retrospective search.
Monitor for anomalous JavaScript execution and outbound beaconing from browsers rendering CMS-hosted pages.

How to Mitigate CVE-2025-5286

Immediate Actions Required

Update the Bold Page Builder plugin to version 5.3.7 or later on all WordPress installations.
Audit existing posts and pages for malicious additional_settings attribute content and remove any injected payloads.
Review Contributor and Author accounts for legitimacy and reset credentials for accounts that submitted suspicious content.

Patch Information

The vendor released Bold Page Builder version 5.3.7, which adds sanitization and escaping to the additional_settings parameter. The fix is documented in WordPress Plugin Changeset #3302452 and referenced in the Wordfence Vulnerability Report. Plugin update details are available on the Bold Page Builder Developer Info page.

Workarounds

Deactivate the Bold Page Builder plugin until the site can be updated to version 5.3.7.
Restrict Contributor and Author role assignments to trusted users only and require editorial review before publishing.
Deploy a web application firewall rule that blocks <script> tags and JavaScript event handlers inside shortcode attributes on POST requests to wp-admin/post.php and wp-admin/admin-ajax.php.

bash

# Configuration example: update Bold Page Builder via WP-CLI
wp plugin update bold-page-builder --version=5.3.7
wp plugin get bold-page-builder --field=version