CVE-2025-54006: Bold Page Builder Stored XSS Vulnerability

CVE-2025-54006 Overview

CVE-2025-54006 is a stored cross-site scripting (XSS) vulnerability in the boldthemes Bold Page Builder plugin for WordPress. The flaw affects all versions of bold-page-builder up to and including 5.4.1. Attackers with contributor-level or higher privileges can inject malicious JavaScript that persists in the database. When administrators or other visitors view the affected page, the payload executes in their browser session. The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the browsers of site administrators, enabling session theft, account takeover, and privilege escalation across the WordPress environment.

Affected Products

boldthemes Bold Page Builder for WordPress (bold-page-builder) versions through 5.4.1
WordPress sites with the plugin installed and activated
Any user role permitted to author or edit content using the page builder

Discovery Timeline

2025-07-16 - CVE-2025-54006 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54006

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input rendered in web pages generated by Bold Page Builder. Content submitted through builder components is stored in the WordPress database without sufficient sanitization or output encoding. When the affected page or post loads, the injected script executes within the browser context of the viewer.

Stored XSS in a page builder plugin extends the blast radius beyond a single request. Because payloads persist in wp_posts or plugin-specific tables, every visitor to the compromised page becomes a target. Administrators reviewing content are the highest-value victims, since session cookies and nonces harvested from an admin session enable arbitrary plugin installation and full site compromise.

The scope-changed impact reflects that a payload authored by a low-privilege user executes in the context of a higher-privilege browser session.

Root Cause

Bold Page Builder processes shortcode attributes and widget parameters that accept user-controlled strings. These values are echoed into the rendered page markup without being passed through WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post(). The absence of context-aware output encoding allows HTML and JavaScript to break out of the intended attribute or text node.

Attack Vector

Exploitation requires an authenticated user with permission to create or edit content through the page builder. The attacker crafts a builder element containing a JavaScript payload inside an attribute that is later reflected into the page HTML. User interaction is required: an administrator or visitor must load the page containing the malicious element. Once loaded, the script runs with the victim's session privileges and can issue authenticated requests to WordPress REST endpoints. Refer to the Patchstack Vulnerability Report for the specific injection points.

Detection Methods for CVE-2025-54006

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: handlers inside posts, pages, or page-builder metadata
New administrator accounts or role changes not initiated by legitimate staff
Outbound requests from browsers loading affected pages to unfamiliar domains
Modifications to plugin files, .htaccess, or WordPress options shortly after an admin viewed an edited page

Detection Strategies

Query the wp_posts and Bold Page Builder metadata tables for HTML event handlers and <script> fragments
Enable a Content Security Policy in report-only mode to surface unexpected inline script execution
Review WordPress audit logs for content edits by contributor or author accounts followed by admin page views
Scan installed plugin versions with a vulnerability database feed to flag bold-page-builder builds at or below 5.4.1

Monitoring Recommendations

Alert on creation of new WordPress users with administrator role or capability changes via the REST API
Monitor web server logs for repeated POST requests to /wp-admin/admin-ajax.php from low-privilege sessions
Track browser console errors and CSP violation reports originating from WordPress front-end pages
Baseline outbound network connections from workstations used by site administrators

How to Mitigate CVE-2025-54006

Immediate Actions Required

Upgrade Bold Page Builder to a release later than 5.4.1 once the vendor publishes a fixed version
Audit all contributor, author, and editor accounts and remove any that are unused or unverified
Review existing pages built with the plugin for unexpected HTML, script tags, or event handlers
Rotate WordPress administrator passwords and invalidate active sessions after remediation

Patch Information

At publication, the Patchstack Vulnerability Report lists versions through 5.4.1 as affected. Site operators should monitor the plugin changelog and apply the vendor-supplied update as soon as it is released. Confirm the installed version under wp-admin/plugins.php after patching.

Workarounds

Deactivate Bold Page Builder until a fixed version is available if the plugin is not business-critical
Restrict content authoring capabilities to trusted accounts and disable self-registration
Deploy a web application firewall rule that blocks requests containing script tags or event handlers destined for page builder endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress front-end pages

bash

# Configuration example
# Verify installed plugin version
wp plugin get bold-page-builder --field=version

# Temporarily deactivate until a patched release is available
wp plugin deactivate bold-page-builder

# Restrict contributor and author roles from unsafe HTML
wp cap remove contributor unfiltered_html
wp cap remove author unfiltered_html